Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:file.exe
Analysis ID:1451180
MD5:60feb08011db31607cee2a5bc1f2206f
SHA1:f8f680a3a8ca7eb2058eebdf2f25a95904780988
SHA256:20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2
Tags:exe
Infos:

Detection

Score:40
Range:0 - 100
Whitelisted:false
Confidence:100%

Compliance

Score:49
Range:0 - 100

Signatures

Malicious sample detected (through community Yara rule)
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to prevent local Windows debugging
Creates an undocumented autostart registry key
Creates multiple autostart registry keys
Found evasive API chain (may stop execution after checking volume information)
Found evasive API chain checking for user administrative privileges
Query firmware table information (likely to detect VMs)
Tries to harvest and steal browser information (history, passwords, etc)
Changes image file execution options
Checks for available system drives (often done to infect USB drives)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to dynamically determine API calls
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates COM task schedule object (often to register a task for autostart)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected potential crypto function
Disables exception chain validation (SEHOP)
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (may stop execution after accessing registry keys)
Found evasive API chain (may stop execution after checking a module file name)
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file contains strange resources
PE file does not import any functions
Queries disk information (often used to detect virtual machines)
Queries keyboard layouts
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Common Autorun Keys Modification
Sigma detected: CurrentVersion Autorun Keys Modification
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • file.exe (PID: 1268 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 60FEB08011DB31607CEE2A5BC1F2206F)
    • ajF04F.exe (PID: 1684 cmdline: "C:\Users\user\AppData\Local\Temp\ajF04F.exe" /relaunch=8 /was_elevated=1 /tagdata MD5: ACB51434FD82EB460B052F05950B8DCA)
      • AVGBrowserUpdateSetup.exe (PID: 1576 cmdline: AVGBrowserUpdateSetup.exe /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-GB&brand=9249&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dchrome --import-cookies --auto-launch-chrome" MD5: 9750EA6C750629D2CA971AB1C074DC9D)
        • AVGBrowserUpdate.exe (PID: 3116 cmdline: "C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe" /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-GB&brand=9249&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dchrome --import-cookies --auto-launch-chrome" MD5: CBCDF56C8A2788ED761AD3178E2D6E9C)
          • AVGBrowserUpdate.exe (PID: 6448 cmdline: "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regsvc MD5: CBCDF56C8A2788ED761AD3178E2D6E9C)
          • AVGBrowserUpdate.exe (PID: 5696 cmdline: "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regserver MD5: CBCDF56C8A2788ED761AD3178E2D6E9C)
            • AVGBrowserUpdateComRegisterShell64.exe (PID: 6580 cmdline: "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe" MD5: 2A3AD7362E6C8808FBB4D4CCABA4ED4A)
            • AVGBrowserUpdateComRegisterShell64.exe (PID: 2636 cmdline: "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe" MD5: 2A3AD7362E6C8808FBB4D4CCABA4ED4A)
            • AVGBrowserUpdateComRegisterShell64.exe (PID: 5016 cmdline: "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe" MD5: 2A3AD7362E6C8808FBB4D4CCABA4ED4A)
          • AVGBrowserUpdate.exe (PID: 7272 cmdline: "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTY5My42IiBzaGVsbF92ZXJzaW9uPSIxLjguMTY5My42IiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0iezc2MzdDRkNCLUUwOEQtNDNENC1CMUY3LUMyNERBQjEzQkI4MH0iIGNlcnRfZXhwX2RhdGU9IjIwMjUwOTE3IiB1c2VyaWQ9IntFMUJBQjY4OC1CMDJGLTQ3NDktOUY4OC0zRTFCNEU3REE5OTR9IiB1c2VyaWRfZGF0ZT0iMjAyNDA2MDMiIG1hY2hpbmVpZD0iezAwMDBGOEI1LUM3REUtQTQ4Qy1EMDU4LTA3RTI0NTVCOUE1Qn0iIG1hY2hpbmVpZF9kYXRlPSIyMDI0MDYwMyIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9InsyNTJFNzAzQS1GNkRGLTRBQjYtOTE2MS00NEZENUYwNjYwMER9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDUuMjAwNiIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuOC4xNjkzLjYiIGxhbmc9ImVuLUdCIiBicmFuZD0iOTI0OSIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iNjA2MyIvPjwvYXBwPjwvcmVxdWVzdD4 MD5: CBCDF56C8A2788ED761AD3178E2D6E9C)
          • AVGBrowserUpdate.exe (PID: 7288 cmdline: "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /handoff "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-GB&brand=9249&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dchrome --import-cookies --auto-launch-chrome" /installsource otherinstallcmd /sessionid "{7637CFCB-E08D-43D4-B1F7-C24DAB13BB80}" /silent MD5: CBCDF56C8A2788ED761AD3178E2D6E9C)
      • AVGBrowser.exe (PID: 5404 cmdline: AVGBrowser.exe --heartbeat --install --create-profile MD5: 7BD74C28BFADFF16A053A3B5E2B51195)
  • svchost.exe (PID: 6784 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • AVGBrowserUpdate.exe (PID: 2504 cmdline: "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /c MD5: CBCDF56C8A2788ED761AD3178E2D6E9C)
  • AVGBrowserUpdate.exe (PID: 6208 cmdline: "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ua /installsource scheduler MD5: CBCDF56C8A2788ED761AD3178E2D6E9C)
    • AVGBrowserUpdate.exe (PID: 2636 cmdline: "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /registermsihelper MD5: CBCDF56C8A2788ED761AD3178E2D6E9C)
    • AVGBrowserUpdate.exe (PID: 7432 cmdline: "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /uninstall MD5: CBCDF56C8A2788ED761AD3178E2D6E9C)
  • msiexec.exe (PID: 5452 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)
  • AVGBrowserUpdate.exe (PID: 7348 cmdline: "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc MD5: CBCDF56C8A2788ED761AD3178E2D6E9C)
    • AVGBrowserInstaller.exe (PID: 7536 cmdline: "C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\AVGBrowserInstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=chrome --import-cookies --auto-launch-chrome --system-level MD5: 371F796FCFD9D0BA16C7DA57487323A0)
      • setup.exe (PID: 7676 cmdline: "C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe" --install-archive="C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\SECURE.PACKED.7Z" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=chrome --import-cookies --auto-launch-chrome --system-level MD5: 0DFA65976DA7822DB99118ABF2A50CC9)
        • setup.exe (PID: 7692 cmdline: "C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=124.0.25069.209 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff60185a3f0,0x7ff60185a3fc,0x7ff60185a408 MD5: 0DFA65976DA7822DB99118ABF2A50CC9)
    • AVGBrowserCrashHandler.exe (PID: 4672 cmdline: "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe" MD5: F73E60370EFE16A6D985E564275612DA)
    • AVGBrowserCrashHandler64.exe (PID: 4996 cmdline: "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe" MD5: DEEF1E7382D212CD403431727BE417A5)
  • svchost.exe (PID: 7576 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • AVGBrowser.exe (PID: 8044 cmdline: "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=heartbeat --hourly MD5: 7BD74C28BFADFF16A053A3B5E2B51195)
    • AVGBrowser.exe (PID: 8108 cmdline: "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --heartbeat --hourly MD5: 7BD74C28BFADFF16A053A3B5E2B51195)
      • AVGBrowser.exe (PID: 8152 cmdline: "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\Temp\\Heartbeat8108_647370180 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\Temp\\Heartbeat8108_647370180\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=124.0.25069.209 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8a7b0dc40,0x7ff8a7b0dc4c,0x7ff8a7b0dc58 MD5: 7BD74C28BFADFF16A053A3B5E2B51195)
      • AVGBrowser.exe (PID: 7452 cmdline: "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2124,i,2166630059599507292,14770330184015614422,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:2 MD5: 7BD74C28BFADFF16A053A3B5E2B51195)
  • AVGBrowser.exe (PID: 8060 cmdline: "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=heartbeat --logon MD5: 7BD74C28BFADFF16A053A3B5E2B51195)
    • AVGBrowser.exe (PID: 8128 cmdline: "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --heartbeat --logon MD5: 7BD74C28BFADFF16A053A3B5E2B51195)
      • AVGBrowser.exe (PID: 8160 cmdline: "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\Temp\\Heartbeat8128_116327840 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\Temp\\Heartbeat8128_116327840\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=124.0.25069.209 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8a7b0dc40,0x7ff8a7b0dc4c,0x7ff8a7b0dc58 MD5: 7BD74C28BFADFF16A053A3B5E2B51195)
      • AVGBrowser.exe (PID: 7440 cmdline: "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2028,i,14563547802735666349,826896251076988020,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2 MD5: 7BD74C28BFADFF16A053A3B5E2B51195)
  • elevation_service.exe (PID: 5856 cmdline: "C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exe" MD5: A4FA49989838F0B3038A008870561894)
  • svchost.exe (PID: 1124 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • elevation_service.exe (PID: 5704 cmdline: "C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exe" MD5: A4FA49989838F0B3038A008870561894)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmpPlugXStringsPlugX Identifying StringsSeth Hardy
  • 0x143404:$Dwork: D:\work
  • 0x143460:$Dwork: D:\work
  • 0x1497d8:$Dwork: D:\work
  • 0x1e2c68:$Dwork: D:\work
  • 0x1e2cc8:$Dwork: D:\work
  • 0x1e95e0:$Dwork: D:\work
  • 0x428c98:$Dwork: D:\work
  • 0x428df0:$Dwork: D:\work
  • 0x428f58:$Dwork: D:\work
  • 0x429030:$Dwork: D:\work
  • 0x429290:$Dwork: D:\work
  • 0x4293b0:$Dwork: D:\work
  • 0x4294d0:$Dwork: D:\work
  • 0x429580:$Dwork: D:\work
  • 0x50ca3:$Shell6: Shell6
  • 0xa7533:$Shell6: Shell6
00000004.00000003.2112481989.0000000002C6C000.00000004.00000020.00020000.00000000.sdmpPlugXStringsPlugX Identifying StringsSeth Hardy
  • 0x143404:$Dwork: D:\work
  • 0x143460:$Dwork: D:\work
  • 0x1497d8:$Dwork: D:\work
  • 0x1e2c68:$Dwork: D:\work
  • 0x1e2cc8:$Dwork: D:\work
  • 0x1e95e0:$Dwork: D:\work
  • 0x428c98:$Dwork: D:\work
  • 0x428df0:$Dwork: D:\work
  • 0x428f58:$Dwork: D:\work
  • 0x429030:$Dwork: D:\work
  • 0x429290:$Dwork: D:\work
  • 0x4293b0:$Dwork: D:\work
  • 0x4294d0:$Dwork: D:\work
  • 0x429580:$Dwork: D:\work
  • 0x50ca3:$Shell6: Shell6
  • 0xa7533:$Shell6: Shell6
00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmpPlugXStringsPlugX Identifying StringsSeth Hardy
  • 0x158674:$Dwork: D:\work
  • 0x1586d0:$Dwork: D:\work
  • 0x15eab0:$Dwork: D:\work
  • 0x201b58:$Dwork: D:\work
  • 0x201bb8:$Dwork: D:\work
  • 0x2084f0:$Dwork: D:\work
  • 0x470ac0:$Dwork: D:\work
  • 0x470c18:$Dwork: D:\work
  • 0x470d80:$Dwork: D:\work
  • 0x470e58:$Dwork: D:\work
  • 0x4710b8:$Dwork: D:\work
  • 0x4711d8:$Dwork: D:\work
  • 0x4712f8:$Dwork: D:\work
  • 0x4713a8:$Dwork: D:\work
  • 0x5343b:$Shell6: Shell6
  • 0xb0fcf:$Shell6: Shell6
Process Memory Space: AVGBrowserUpdateSetup.exe PID: 1576PlugXStringsPlugX Identifying StringsSeth Hardy
  • 0x16e16:$Dwork: D:\work
  • 0x16ee5:$Dwork: D:\work
  • 0x18123:$Dwork: D:\work
  • 0x18229:$Dwork: D:\work
  • 0x18433:$Dwork: D:\work
  • 0x18490:$Dwork: D:\work
  • 0x18521:$Dwork: D:\work
  • 0x1e83e:$Dwork: D:\work
  • 0x24cbc:$Dwork: D:\work
  • 0x24eea:$Dwork: D:\work
  • 0x25a79:$Dwork: D:\work
  • 0x25fe8:$Dwork: D:\work
  • 0x2614e:$Dwork: D:\work
  • 0x262b6:$Dwork: D:\work
  • 0x29bef:$Dwork: D:\work
  • 0x29d87:$Dwork: D:\work
  • 0x29e08:$Dwork: D:\work
  • 0x2a014:$Dwork: D:\work
  • 0x2a37f:$Dwork: D:\work
  • 0x2a50f:$Dwork: D:\work
  • 0x2a58f:$Dwork: D:\work
Process Memory Space: AVGBrowserUpdate.exe PID: 3116PlugXStringsPlugX Identifying StringsSeth Hardy
  • 0x549e3:$Dwork: D:\work
  • 0x6512f:$Dwork: D:\work
  • 0x6527d:$Dwork: D:\work
  • 0x653d4:$Dwork: D:\work
  • 0x654a2:$Dwork: D:\work
  • 0x6586f:$Dwork: D:\work
  • 0x659b9:$Dwork: D:\work
  • 0x65b0d:$Dwork: D:\work
  • 0x65bd8:$Dwork: D:\work
  • 0x65e05:$Dwork: D:\work
  • 0x65f2c:$Dwork: D:\work
  • 0x66030:$Dwork: D:\work
  • 0x66148:$Dwork: D:\work
  • 0x661f2:$Dwork: D:\work
  • 0x662c8:$Dwork: D:\work
  • 0x663dd:$Dwork: D:\work
  • 0x66485:$Dwork: D:\work
  • 0x8b922:$Dwork: D:\work
  • 0x8c512:$Dwork: D:\work
  • 0xd8df7:$Dwork: D:\work
  • 0xde5b7:$Dwork: D:\work
Click to see the 3 entries

Unpacked PEs

SourceRuleDescriptionAuthorStrings
4.3.AVGBrowserUpdateSetup.exe.34af14c.173.raw.unpackPlugXStringsPlugX Identifying StringsSeth Hardy
  • 0x1172b8:$Dwork: D:\work
  • 0x117314:$Dwork: D:\work
  • 0x11d68c:$Dwork: D:\work
  • 0x1b6b1c:$Dwork: D:\work
  • 0x1b6b7c:$Dwork: D:\work
  • 0x1bd494:$Dwork: D:\work
  • 0x3fcb4c:$Dwork: D:\work
  • 0x3fcca4:$Dwork: D:\work
  • 0x3fce0c:$Dwork: D:\work
  • 0x3fcee4:$Dwork: D:\work
  • 0x3fd144:$Dwork: D:\work
  • 0x3fd264:$Dwork: D:\work
  • 0x3fd384:$Dwork: D:\work
  • 0x3fd434:$Dwork: D:\work
  • 0x24b57:$Shell6: Shell6
  • 0x7b3e7:$Shell6: Shell6
4.3.AVGBrowserUpdateSetup.exe.348a40c.135.raw.unpackPlugXStringsPlugX Identifying StringsSeth Hardy
  • 0x13bff8:$Dwork: D:\work
  • 0x13c054:$Dwork: D:\work
  • 0x1423cc:$Dwork: D:\work
  • 0x1db85c:$Dwork: D:\work
  • 0x1db8bc:$Dwork: D:\work
  • 0x1e21d4:$Dwork: D:\work
  • 0x42188c:$Dwork: D:\work
  • 0x4219e4:$Dwork: D:\work
  • 0x421b4c:$Dwork: D:\work
  • 0x421c24:$Dwork: D:\work
  • 0x421e84:$Dwork: D:\work
  • 0x421fa4:$Dwork: D:\work
  • 0x4220c4:$Dwork: D:\work
  • 0x422174:$Dwork: D:\work
  • 0x49897:$Shell6: Shell6
  • 0xa0127:$Shell6: Shell6
4.3.AVGBrowserUpdateSetup.exe.3e64620.92.raw.unpackPlugXStringsPlugX Identifying StringsSeth Hardy
  • 0x105054:$Dwork: D:\work
  • 0x1050b0:$Dwork: D:\work
  • 0x10b490:$Dwork: D:\work
  • 0x1ae538:$Dwork: D:\work
  • 0x1ae598:$Dwork: D:\work
  • 0x1b4ed0:$Dwork: D:\work
  • 0x41d4a0:$Dwork: D:\work
  • 0x41d5f8:$Dwork: D:\work
  • 0x41d760:$Dwork: D:\work
  • 0x41d838:$Dwork: D:\work
  • 0x41da98:$Dwork: D:\work
  • 0x41dbb8:$Dwork: D:\work
  • 0x41dcd8:$Dwork: D:\work
  • 0x41dd88:$Dwork: D:\work
  • 0x5d9af:$Shell6: Shell6
4.3.AVGBrowserUpdateSetup.exe.2c7340c.48.raw.unpackPlugXStringsPlugX Identifying StringsSeth Hardy
  • 0x13bff8:$Dwork: D:\work
  • 0x13c054:$Dwork: D:\work
  • 0x1423cc:$Dwork: D:\work
  • 0x1db85c:$Dwork: D:\work
  • 0x1db8bc:$Dwork: D:\work
  • 0x1e21d4:$Dwork: D:\work
  • 0x42188c:$Dwork: D:\work
  • 0x4219e4:$Dwork: D:\work
  • 0x421b4c:$Dwork: D:\work
  • 0x421c24:$Dwork: D:\work
  • 0x421e84:$Dwork: D:\work
  • 0x421fa4:$Dwork: D:\work
  • 0x4220c4:$Dwork: D:\work
  • 0x422174:$Dwork: D:\work
  • 0x49897:$Shell6: Shell6
  • 0xa0127:$Shell6: Shell6
4.3.AVGBrowserUpdateSetup.exe.2cbce88.51.raw.unpackPlugXStringsPlugX Identifying StringsSeth Hardy
  • 0xf257c:$Dwork: D:\work
  • 0xf25d8:$Dwork: D:\work
  • 0xf8950:$Dwork: D:\work
  • 0x191de0:$Dwork: D:\work
  • 0x191e40:$Dwork: D:\work
  • 0x198758:$Dwork: D:\work
  • 0x3d7e10:$Dwork: D:\work
  • 0x3d7f68:$Dwork: D:\work
  • 0x3d80d0:$Dwork: D:\work
  • 0x3d81a8:$Dwork: D:\work
  • 0x3d8408:$Dwork: D:\work
  • 0x3d8528:$Dwork: D:\work
  • 0x3d8648:$Dwork: D:\work
  • 0x3d86f8:$Dwork: D:\work
  • 0x566ab:$Shell6: Shell6
Click to see the 4 entries

Sigma Signatures

System Summary

barindex
Sigma detected: Common Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), wagga (name): Data: Details: AVG Secure Browser, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe, ProcessId: 7676, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\(Default)
Sigma detected: CurrentVersion Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --check-run=src=logon --auto-launch-at-startup --profile-directory="Default", EventID: 13, EventType: SetValue, Image: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe, ProcessId: 8108, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVGBrowserAutoLaunch_53F4AD9791D53E4F31988DF26A2B411E
Sigma detected: Windows Processes Suspicious Parent Directory
Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6784, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Compliance

barindex
Uses 32bit PE files
Source: file.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Creates a directory in C:\Program Files
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeDirectory created: C:\Program Files\AVG\Browser\AVGBrowserUninstall.exeJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\secure.7z
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Extensions
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\MEIPreload
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\VisualElements
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\124.0.25069.209.manifest
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\aswEngineConnector.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\AVGBrowser.exe.sig
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\browser_crash_reporter.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\chrome.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\chrome.dll.sig
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\chrome_100_percent.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\chrome_200_percent.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\chrome_elf.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\chrome_pwa_launcher.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\chrome_wer.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\config.def
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\d3dcompiler_47.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\dxcompiler.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\dxil.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\elevation_service.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\eventlog_provider.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Extensions\external_extensions.json
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\ffmpeg.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\icudtl.dat
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\libEGL.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\libGLESv2.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\af.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\am.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\ar.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\bg.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\bn.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\ca.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\cs.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\da.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\de.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\el.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\en-GB.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\en-US.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\es-419.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\es.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\et.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\fa.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\fi.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\fil.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\fr.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\gu.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\he.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\hi.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\hr.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\hu.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\id.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\it.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\ja.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\kn.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\ko.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\lt.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\lv.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\ml.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\mr.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\ms.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\nb.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\nl.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\pl.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\pt-BR.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\pt-PT.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\ro.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\ru.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\sk.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\sl.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\sr.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\sv.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\sw.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\ta.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\te.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\th.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\tr.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\uk.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\ur.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\vi.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\zh-CN.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\zh-TW.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\MEIPreload\manifest.json
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\MEIPreload\preloaded_data.pb
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\mimic.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\mojo_core.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\notification_helper.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\resources.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\setup_helper_syslib.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\snapshot_blob.bin
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\v8_context_snapshot.bin
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\VisualElements\Logo.png
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\VisualElements\SmallLogo.png
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\vk_swiftshader.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\vk_swiftshader_icd.json
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\vulkan-1.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\AVGBrowser.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\AVGBrowserProtect.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\AVGBrowserQHelper.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\AVGBrowserUninstall.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\browser_proxy.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\initial_preferences
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\AVGBrowser.VisualElementsManifest.xml
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Application
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Application\SetupMetrics
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Application\124.0.25069.209\Installer
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Application\124.0.25069.209\Installer\setup.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Application\124.0.25069.209\Installer\chrmstp.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Application\browser_proxy.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Application\initial_preferences
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Application\AVGBrowserQHelper.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Application\SetupMetrics\9235c4e7-ae53-479e-b681-9b7e025f31b5.tmp
Creates install or setup log file
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeFile created: C:\Users\user\AppData\Local\Temp\AVGBrowser_installer.log
PE / OLE file has a valid certificate
Source: file.exeStatic PE information: certificate valid
Contains modern PE file flags such as dynamic base (ASLR) or NX
Source: file.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Binary contains paths to debug symbols
Source: Binary string: goopdateres_unsigned_ms.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000003222000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000440F000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2165133974.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2165205878.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2164927132.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_fa.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003961000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004337000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2152791561.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2152687306.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2152408496.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_ru.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000445F000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003A89000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2168125977.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2168061555.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2167925652.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_lt.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000043E1000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003A0B000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2163524223.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2163205272.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2163413117.00000000007A5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_el.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000003104000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042F1000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2150108705.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2150018075.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2149856176.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\9736f8b792bcd5e7\src\out\Release-x64\initialexe\AVGBrowser.exe.pdb source: AVGBrowser.exe, 0000001A.00000000.2869521627.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001B.00000000.2872124493.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001C.00000000.2875770965.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001D.00000000.2876092036.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001E.00000000.2878831708.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001F.00000002.2896650039.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp
Source: Binary string: goopdateres_unsigned_tr.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044C7000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2170590288.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_de.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042E6000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2149702229.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2149481017.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2149639323.00000000007A5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_bg.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030C0000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042AD000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2147250436.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2147135412.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2146941772.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_mr.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000003216000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004402000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2164735319.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2164643030.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2164450051.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: AVGBrowserUpdateComRegisterShell64_unsigned.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2145841812.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2146084049.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2146150231.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateComRegisterShell64.exe, 00000009.00000000.2186495616.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmp, AVGBrowserUpdateComRegisterShell64.exe, 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmp, AVGBrowserUpdateComRegisterShell64.exe, 0000000A.00000000.2190630223.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmp, AVGBrowserUpdateComRegisterShell64.exe, 0000000A.00000002.2192620515.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmp, AVGBrowserUpdateComRegisterShell64.exe, 0000000C.00000002.2195344439.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmp, AVGBrowserUpdateComRegisterShell64.exe, 0000000C.00000000.2193531111.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmp
Source: Binary string: AVGBrowserCrashHandler64_unsigned.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2145507317.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\9736f8b792bcd5e7\src\out\Release-x64\setup_nosign.exe.pdb source: setup.exe, 00000017.00000002.2873586684.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, setup.exe, 00000017.00000000.2539988971.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, setup.exe, 00000018.00000002.2876710388.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, setup.exe, 00000018.00000000.2544840578.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp
Source: Binary string: goopdateres_unsigned_gu.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000003177000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004364000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2154278126.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2154217263.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2154003772.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_sr.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002A94000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004481000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2169214564.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2169165916.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2169045548.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_th.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044BB000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2170430862.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psmachine_unsigned.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2172532345.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psmachine_unsigned_64.pdbT source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2172800095.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: AVGBrowserCrashHandler_unsigned.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000326F000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003BCE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psuser_unsigned.pdbX source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2171945813.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\9736f8b792bcd5e7\src\out\Release-avg-x64\mini_installer.exe.pdb source: AVGBrowserInstaller.exe, 00000014.00000000.2482861483.00007FF73BED4000.00000002.00000001.01000000.00000026.sdmp, AVGBrowserInstaller.exe, 00000014.00000002.2879711339.00007FF73BED4000.00000002.00000001.01000000.00000026.sdmp
Source: Binary string: AVGBrowserUpdateOnDemand_unsigned.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\9736f8b792bcd5e7\src\out\Release-x64\chrome_elf.dll.pdb source: AVGBrowser.exe, 0000001E.00000002.2898134802.00007FF8A7ACB000.00000002.00000001.01000000.00000029.sdmp
Source: Binary string: psuser_unsigned_64.pdbT source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2172227367.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_am.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2146198832.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2146406367.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2146331005.00000000007A5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: AVGBrowserUpdateWebPlugin_unsigned.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_ta.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044A3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003ACD000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2170084642.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_lv.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000043EC000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2163686580.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2163921549.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2163990015.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_cs.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030E2000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042CF000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2148756524.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2149020532.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2148956582.00000000007A5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdate_unsigned.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002B23000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000326F000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003BCE000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2143860339.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_hi.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000399A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004370000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2154799321.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2154508962.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2154944559.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: AVGBrowserUpdateBroker_unsigned.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2176127906.0000000000782000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_es-419.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003949000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000431F000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2151812044.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2151812044.00000000007A4000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2151560568.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mi_exe_stub.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000000.2108944984.0000000000B28000.00000002.00000001.01000000.00000018.sdmp
Source: Binary string: goopdateres_unsigned_pt-BR.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000443D000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003A67000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2167065963.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2166860815.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2167145584.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_hr.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000437C000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.000000000318F000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2155429261.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2155653574.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2155088171.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_id.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004392000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000031A6000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2159583853.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2159098504.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2158363262.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psuser_unsigned_64.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2172227367.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: AVGBrowserUpdateComRegisterShell64_unsigned.pdb^ source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2145841812.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2146084049.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2146150231.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateComRegisterShell64.exe, 00000009.00000000.2186495616.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmp, AVGBrowserUpdateComRegisterShell64.exe, 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmp, AVGBrowserUpdateComRegisterShell64.exe, 0000000A.00000000.2190630223.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmp, AVGBrowserUpdateComRegisterShell64.exe, 0000000A.00000002.2192620515.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmp, AVGBrowserUpdateComRegisterShell64.exe, 0000000C.00000002.2195344439.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmp, AVGBrowserUpdateComRegisterShell64.exe, 0000000C.00000000.2193531111.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmp
Source: Binary string: goopdateres_unsigned_zh-TW.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044FF000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000002.2908350799.0000000000ABF000.00000004.00000010.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2171629574.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psmachine_unsigned.pdbX source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2172532345.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_sw.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002AAB000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004498000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2169921274.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2169760351.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2169979059.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_it.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000043A9000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.00000000039D3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2160342541.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2160573365.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2160666549.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_pt-PT.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003A72000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004448000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2167235240.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2167405477.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2167460912.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_vi.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044E8000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003B13000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2171109384.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_bn.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042B8000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2147746330.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2147854898.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2147498223.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: acuapi_64_unsigned.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2173471506.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_sv.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000448D000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002AA0000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2169451957.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2169609203.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2169288884.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_ja.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000031D3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2161534514.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2161282116.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2161673996.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_es.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000393E000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004314000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2151022828.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2151295194.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2151365862.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_is.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.00000000039C8000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000439E000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2159809709.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2160034051.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2160191266.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_ro.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003A7E000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004453000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2167789427.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2167735488.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2167562873.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_uk.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002AE5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044D2000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2170749651.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_fr.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003983000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004358000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2153691467.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2153837503.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2153911762.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_ca.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030D6000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042C3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2148671542.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2148513714.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2148000470.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_nl.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000441A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.000000000322D000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2165310044.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2165673173.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2165540989.00000000007A5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_ko.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000031E9000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000043D6000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2162834499.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2162957240.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2162442370.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_et.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.000000000313E000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000432B000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2152035302.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2152168818.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2152246594.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_ur.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003B07000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044DD000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2170927202.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_no.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000003239000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004426000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2166353148.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2165885183.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2166432853.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_iw.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000031C8000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000043B5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2161092400.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2160811345.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2160987300.00000000007A5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_te.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003AD9000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044AF000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2170266211.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_fil.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003977000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000434D000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2153610715.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2153306642.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2153556127.00000000007A5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_pl.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004431000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003A5B000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2166681516.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2166534186.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2166754218.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_en-GB.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003933000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004309000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000002.2900499809.0000000000A10000.00000002.00000001.00040000.0000002D.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2150672751.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2150920384.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2150858095.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000011.00000002.2888623349.0000000000C00000.00000002.00000001.00040000.0000002C.sdmp, AVGBrowserUpdate.exe, 00000012.00000002.2896108642.00000000013E0000.00000002.00000001.00040000.0000002C.sdmp
Source: Binary string: goopdateres_unsigned_fi.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000396C000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004342000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2152886939.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2153171386.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2153084030.00000000007A5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_sk.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000446A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002A7E000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2168546407.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2168236782.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2168465236.00000000007A5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psuser_unsigned.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2171945813.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_ml.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.000000000320A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000043F7000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2164264655.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2164335990.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2164095384.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: npAvgBrowserUpdate3_unsigned.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002B23000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000326F000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003BCE000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2176075476.0000000000781000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2176029036.0000000000791000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_hu.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004387000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.000000000319A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2156600983.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2157791884.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2158175358.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_da.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003905000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042DB000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2149386687.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2149172877.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2149326912.00000000007A5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_en.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042FD000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000003110000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2150223781.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2150536478.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2150458860.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000006.00000002.2180276782.0000000000C20000.00000002.00000001.00040000.0000001E.sdmp, AVGBrowserUpdate.exe, 0000000D.00000002.2292632206.0000000000F60000.00000002.00000001.00040000.0000001E.sdmp, AVGBrowserUpdate.exe, 00000012.00000002.2896542114.00000000014B0000.00000002.00000001.00040000.0000001E.sdmp
Source: Binary string: psmachine_unsigned_64.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2172800095.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_ar.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.00000000038CC000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042A2000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2146568139.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2146833064.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2146745656.00000000007A5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_sl.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002A89000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004476000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2168861429.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2168701046.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2168945218.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: AVGBrowserUpdate_unsigned.pdb source: AVGBrowserUpdate.exe, AVGBrowserUpdate.exe, 00000006.00000002.2179645124.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, AVGBrowserUpdate.exe, 00000008.00000000.2185347276.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, AVGBrowserUpdate.exe, 0000000B.00000000.2192928136.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, AVGBrowserUpdate.exe, 0000000D.00000000.2193569917.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, AVGBrowserUpdate.exe, 0000000E.00000002.2217270400.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, AVGBrowserUpdate.exe, 00000010.00000002.2244031208.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, AVGBrowserUpdate.exe, 00000011.00000002.2887745804.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, AVGBrowserUpdate.exe, 00000012.00000000.2227648919.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, AVGBrowserUpdate.exe, 00000013.00000002.2284298938.0000000000071000.00000020.00000001.01000000.0000001C.sdmp
Source: Binary string: goopdateres_unsigned_zh-CN.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044F4000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002B07000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2171368998.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_kn.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000031DE000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000043CB000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2162128901.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2162261282.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2161914207.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: acuapi_unsigned.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2173194656.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: AVGBrowserUpdateCore_unsigned.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000002.2908350799.0000000000AC4000.00000004.00000010.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2145023147.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Windows\System32\msiexec.exeFile opened: z:
Source: C:\Windows\System32\msiexec.exeFile opened: x:
Source: C:\Windows\System32\msiexec.exeFile opened: v:
Source: C:\Windows\System32\msiexec.exeFile opened: t:
Source: C:\Windows\System32\msiexec.exeFile opened: r:
Source: C:\Windows\System32\msiexec.exeFile opened: p:
Source: C:\Windows\System32\msiexec.exeFile opened: n:
Source: C:\Windows\System32\msiexec.exeFile opened: l:
Source: C:\Windows\System32\msiexec.exeFile opened: j:
Source: C:\Windows\System32\msiexec.exeFile opened: h:
Source: C:\Windows\System32\msiexec.exeFile opened: f:
Source: C:\Windows\System32\msiexec.exeFile opened: b:
Source: C:\Windows\System32\msiexec.exeFile opened: y:
Source: C:\Windows\System32\msiexec.exeFile opened: w:
Source: C:\Windows\System32\msiexec.exeFile opened: u:
Source: C:\Windows\System32\msiexec.exeFile opened: s:
Source: C:\Windows\System32\msiexec.exeFile opened: q:
Source: C:\Windows\System32\msiexec.exeFile opened: o:
Source: C:\Windows\System32\msiexec.exeFile opened: m:
Source: C:\Windows\System32\msiexec.exeFile opened: k:
Source: C:\Windows\System32\msiexec.exeFile opened: i:
Source: C:\Windows\System32\msiexec.exeFile opened: g:
Source: C:\Windows\System32\msiexec.exeFile opened: e:
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeFile opened: c:
Source: C:\Windows\System32\msiexec.exeFile opened: a:
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32Jump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32Jump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandlerJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32Jump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32Jump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandlerJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32Jump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32Jump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandlerJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32Jump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServerJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\ElevationJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32Jump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32Jump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandlerJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeCode function: 4_2_00B1C375 FindFirstFileExW,4_2_00B1C375
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeCode function: 5_2_00A6D8AF FindFirstFileExW,5_2_00A6D8AF
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeCode function: 6_2_0007D8AF FindFirstFileExW,6_2_0007D8AF
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B4F014 FindFirstFileExW,9_2_00007FF677B4F014
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exeCode function: 32_2_00776015 FindFirstFileExW,32_2_00776015
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exeCode function: 33_2_00007FF60BFD6F4C _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,33_2_00007FF60BFD6F4C
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile opened: C:\Users\userJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile opened: C:\Users\user\AppData\Local\Google\ChromeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile opened: C:\Users\user\AppDataJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User DataJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile opened: C:\Users\user\AppData\Local\GoogleJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile opened: C:\Users\user\AppData\LocalJump to behavior
Source: Joe Sandbox ViewIP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox ViewIP Address: 184.28.90.27 184.28.90.27
Source: AVGBrowser.exe, 0000001C.00000003.3000072043.00001B1C02D40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: Yahoo!yahoo.comhttps://www.yahoo.com/favicon.icohttps://ch.search.yahoo.com/yhs/search{google:pathWildcard}?hspart=avg&hsimp=yhs-securebrowser&type={yahoo:campaignId}&param1={yahoo:param1}&param2={yahoo:param2}&param3={yahoo:param3}&param4={yahoo:param4}&p={searchTerms}UTF-8http://sugg.ch.search.yahoo.com/gossip-ch-partner/?output=fxjson&appid=avg&command={searchTerms} equals www.yahoo.com (Yahoo)
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/1423136
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2162
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2517
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2970
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3078
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3205
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3206
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3452
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3498
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3502
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3577
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3584
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3586
Source: AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3623
Source: AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3624
Source: AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3625
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3832
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3862
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3965
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3970
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4324
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4384
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4405
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4428
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4551
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4633
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4722
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4836
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4901
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4937
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5007
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5055
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5061
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5281
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5371
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5375
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5421
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5430
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5535
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5658
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5750
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5881
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5901
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5906
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6041
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6048
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6141
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6248
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6439
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6651
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6692
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6755
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6860
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6876
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6878
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6929
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6953
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7036
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7047
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7172
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7279
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7370
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7406
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7488
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7553
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7556
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7724
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7760
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7761
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8162
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8215
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8229
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8280
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8291
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8297
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8417
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8484
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8503
Source: AVGBrowserUpdate.exe, 00000012.00000003.2889037888.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000002.2897780593.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000003.2895005428.00000000015A7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://browser-update.avg.com/
Source: AVGBrowserUpdate.exe, 00000012.00000003.2895005428.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000002.2897412994.0000000001582000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000003.2888337213.0000000002950000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://browser-update.avg.com/browser-avg/win/x64/124.0.25069.209/
Source: AVGBrowserUpdate.exe, 00000012.00000002.2897951433.00000000015E8000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000003.2887537422.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000003.2888337213.0000000002950000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000003.2431679167.00000000015E8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://browser-update.avg.com/browser-avg/win/x64/124.0.25069.209/AVGBrowserInstaller.exe
Source: AVGBrowserUpdate.exe, 00000012.00000002.2899056963.00000000031A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://browser-update.avg.com/browser-avg/win/x64/124.0.25069.209/AVGBrowserInstaller.exeam
Source: AVGBrowserUpdate.exe, 00000005.00000003.2172532345.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2171945813.0000000000796000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/
Source: ajF04F.exe, 00000003.00000003.2920688630.0000000003973000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2108302657.0000000004491000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2926022679.00000000044A0000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2925888033.00000000044A0000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2108426382.0000000004499000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002AAB000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000441A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030D6000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042C3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044A3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000446A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003977000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044F4000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002B23000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004431000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030C0000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000396C000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000326F000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003B07000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.00000000038CC000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003A72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: ajF04F.exe, 00000003.00000003.2108302657.0000000004491000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002AAB000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000441A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030D6000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042C3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044A3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000446A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003977000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044F4000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002B23000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004431000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030C0000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000396C000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000326F000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003B07000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.00000000038CC000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003A72000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000003239000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000031E9000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000002.2908350799.0000000000AC4000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: ajF04F.exe, 00000003.00000003.2920688630.0000000003973000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2108302657.0000000004491000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2926022679.00000000044A0000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2925888033.00000000044A0000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2108426382.0000000004499000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002AAB000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000441A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030D6000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042C3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044A3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000446A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003977000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044F4000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002B23000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004431000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030C0000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000396C000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000326F000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003B07000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.00000000038CC000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003A72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: ajF04F.exe, 00000003.00000003.2920688630.0000000003973000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2108302657.0000000004491000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2920975476.0000000004131000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2926022679.00000000044A0000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2925888033.00000000044A0000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2108426382.0000000004499000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002AAB000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000441A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030D6000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042C3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044A3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000446A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003977000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044F4000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002B23000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004431000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030C0000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000396C000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000326F000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003B07000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.00000000038CC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: ajF04F.exe, 00000003.00000003.2920688630.0000000003973000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2108302657.0000000004491000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2926022679.00000000044A0000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2925888033.00000000044A0000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2108426382.0000000004499000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002AAB000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000441A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030D6000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042C3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044A3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000446A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003977000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044F4000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002B23000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004431000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030C0000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000396C000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000326F000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003B07000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.00000000038CC000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003A72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: ajF04F.exe, 00000003.00000003.2108302657.0000000004491000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002AAB000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000441A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030D6000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042C3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044A3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000446A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003977000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044F4000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002B23000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004431000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030C0000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000396C000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000326F000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003B07000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.00000000038CC000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003A72000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000003239000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000031E9000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000002.2908350799.0000000000AC4000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: ajF04F.exe, 00000003.00000003.2920688630.0000000003973000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2108302657.0000000004491000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2926022679.00000000044A0000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2925888033.00000000044A0000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2108426382.0000000004499000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002AAB000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000441A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030D6000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042C3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044A3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000446A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003977000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044F4000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002B23000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004431000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030C0000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000396C000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000326F000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003B07000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.00000000038CC000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003A72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: setup.exe, 00000017.00000003.2847212789.0000020739945000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: ajF04F.exe, 00000003.00000003.2108302657.0000000004491000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002AAB000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000441A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030D6000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042C3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044A3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000446A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003977000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044F4000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002B23000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004431000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030C0000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000396C000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000326F000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003B07000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.00000000038CC000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003A72000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000003239000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000031E9000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000002.2908350799.0000000000AC4000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: svchost.exe, 00000002.00000003.2032432628.000001B642C00000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: AVGBrowser.exe, 0000001C.00000003.3012851459.00001B1C024C0000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012804820.00001B1C024BC000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012959395.00001B1C024C4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986500277.00000FDC024D8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986938270.00000FDC024E0000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986714551.00000FDC024DC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://google.com/
Source: AVGBrowser.exe, 0000001C.00000003.3012851459.00001B1C024C0000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012804820.00001B1C024BC000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012959395.00001B1C024C4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986500277.00000FDC024D8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986938270.00000FDC024E0000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986714551.00000FDC024DC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://google.com/p
Source: AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://issuetracker.google.com/200067929
Source: file.exe, 00000000.00000000.2010109307.000000000040A000.00000008.00000001.01000000.00000003.sdmp, ajF04F.exe, 00000003.00000000.2044910383.000000000040A000.00000008.00000001.01000000.0000000F.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: ajF04F.exe, 00000003.00000003.2920688630.0000000003973000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicerq
Source: ajF04F.exe, 00000003.00000003.2108302657.0000000004491000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002AAB000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000441A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030D6000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042C3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044A3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000446A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003977000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044F4000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002B23000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004431000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030C0000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000396C000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000326F000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003B07000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.00000000038CC000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003A72000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000003239000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000031E9000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000002.2908350799.0000000000AC4000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
Source: ajF04F.exe, 00000003.00000003.2920688630.0000000003973000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2108302657.0000000004491000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2920975476.0000000004131000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2926022679.00000000044A0000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2925888033.00000000044A0000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2108426382.0000000004499000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002AAB000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000441A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030D6000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042C3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044A3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000446A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003977000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044F4000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002B23000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004431000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030C0000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000396C000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000326F000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003B07000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.00000000038CC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
Source: ajF04F.exe, 00000003.00000003.2920688630.0000000003973000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2108302657.0000000004491000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2926022679.00000000044A0000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2925888033.00000000044A0000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2108426382.0000000004499000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002AAB000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000441A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030D6000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042C3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044A3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000446A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003977000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044F4000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002B23000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004431000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030C0000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000396C000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000326F000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003B07000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.00000000038CC000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003A72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
Source: ajF04F.exe, 00000003.00000003.2920688630.0000000003973000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2108302657.0000000004491000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2926022679.00000000044A0000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2925888033.00000000044A0000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2108426382.0000000004499000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002AAB000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000441A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030D6000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042C3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044A3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000446A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003977000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044F4000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002B23000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004431000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030C0000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000396C000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000326F000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003B07000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.00000000038CC000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003A72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
Source: AVGBrowser.exe, 0000001C.00000003.3000072043.00001B1C02D40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://sugg.ch.search.yahoo.com/gossip-ch-partner/?output=fxjson&appid=avg&command=
Source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sv.symcb.com/sv.crt0
Source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sv.symcd.com0&
Source: AVGBrowser.exe, 0000001D.00000003.2950597680.00000FDC029A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://unisolated.invalid/
Source: ajF04F.exe, 00000003.00000003.2108302657.0000000004491000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2926022679.00000000044A0000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2925888033.00000000044A0000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2108426382.0000000004499000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.avast.com
Source: ajF04F.exe, 00000003.00000003.2920688630.0000000003973000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2108302657.0000000004491000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002AAB000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000441A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030D6000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042C3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044A3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000446A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003977000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044F4000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002B23000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004431000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030C0000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000396C000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000326F000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003B07000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.00000000038CC000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003A72000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000003239000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000031E9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.avast.com0/
Source: ajF04F.exe, 00000003.00000003.2108302657.0000000004491000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2926022679.00000000044A0000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2925888033.00000000044A0000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2108426382.0000000004499000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.avast.com1.2.840.113549.1.9.4
Source: ajF04F.exe, 00000003.00000003.2108302657.0000000004491000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002AAB000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000441A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030D6000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042C3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044A3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000446A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003977000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044F4000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002B23000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004431000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030C0000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000396C000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000326F000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003B07000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.00000000038CC000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003A72000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000003239000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000031E9000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000002.2908350799.0000000000AC4000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
Source: AVGBrowser.exe, 0000001C.00000003.3047052872.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011651551.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://abptestpages.org/en/abp-testcase-subscription.txt
Source: AVGBrowser.exe, 0000001C.00000003.3013268260.00001B1C024A8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3013020019.00001B1C0249C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987281454.00000FDC024B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987561449.00000FDC024BC000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.3013972187.00000FDC024C4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987608916.00000FDC024C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: AVGBrowser.exe, 0000001C.00000003.3013268260.00001B1C024A8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3013020019.00001B1C0249C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987281454.00000FDC024B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987561449.00000FDC024BC000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.3013972187.00000FDC024C4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987608916.00000FDC024C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: AVGBrowser.exe, 0000001C.00000003.3013268260.00001B1C024A8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3013020019.00001B1C0249C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987281454.00000FDC024B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987561449.00000FDC024BC000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.3013972187.00000FDC024C4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987608916.00000FDC024C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: AVGBrowser.exe, 0000001C.00000003.3013268260.00001B1C024A8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3013020019.00001B1C0249C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987281454.00000FDC024B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987561449.00000FDC024BC000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.3013972187.00000FDC024C4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987608916.00000FDC024C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: AVGBrowser.exe, 0000001C.00000003.3013268260.00001B1C024A8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3013020019.00001B1C0249C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987281454.00000FDC024B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987561449.00000FDC024BC000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.3013972187.00000FDC024C4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987608916.00000FDC024C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: AVGBrowser.exe, 0000001C.00000003.3013268260.00001B1C024A8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3013020019.00001B1C0249C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987281454.00000FDC024B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987561449.00000FDC024BC000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.3013972187.00000FDC024C4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987608916.00000FDC024C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: AVGBrowser.exe, 0000001C.00000003.3013268260.00001B1C024A8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3013020019.00001B1C0249C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987281454.00000FDC024B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987561449.00000FDC024BC000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.3013972187.00000FDC024C4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987608916.00000FDC024C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: AVGBrowser.exe, 0000001C.00000003.3013268260.00001B1C024A8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3013020019.00001B1C0249C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987281454.00000FDC024B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987561449.00000FDC024BC000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.3013972187.00000FDC024C4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987608916.00000FDC024C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: AVGBrowser.exe, 0000001C.00000003.3013268260.00001B1C024A8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3013020019.00001B1C0249C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987281454.00000FDC024B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987561449.00000FDC024BC000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.3013972187.00000FDC024C4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987608916.00000FDC024C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: AVGBrowser.exe, 0000001C.00000003.3013268260.00001B1C024A8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3013020019.00001B1C0249C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987281454.00000FDC024B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987561449.00000FDC024BC000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.3013972187.00000FDC024C4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987608916.00000FDC024C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: AVGBrowser.exe, 0000001C.00000003.3013268260.00001B1C024A8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3013020019.00001B1C0249C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987281454.00000FDC024B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987561449.00000FDC024BC000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.3013972187.00000FDC024C4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987608916.00000FDC024C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/encryption/unlock/desktopct
Source: AVGBrowser.exe, 0000001C.00000003.3013268260.00001B1C024A8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3013020019.00001B1C0249C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987281454.00000FDC024B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987561449.00000FDC024BC000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.3013972187.00000FDC024C4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987608916.00000FDC024C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: AVGBrowser.exe, 0000001C.00000003.3012102665.00001B1C029B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012296585.00001B1C02E6C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012199682.00001B1C02934000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3017727475.00001B1C02C60000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012373557.00001B1C02E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://addons.avast.com/
Source: AVGBrowser.exe, 0000001C.00000003.3012102665.00001B1C029B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012296585.00001B1C02E6C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012199682.00001B1C02934000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3017727475.00001B1C02C60000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012373557.00001B1C02E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://addons.avast.securebrowser.com
Source: AVGBrowser.exe, 0000001C.00000003.3012102665.00001B1C029B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012296585.00001B1C02E6C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012199682.00001B1C02934000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3017727475.00001B1C02C60000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012373557.00001B1C02E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://addons.avg.com/
Source: AVGBrowser.exe, 0000001C.00000003.3012102665.00001B1C029B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012296585.00001B1C02E6C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012199682.00001B1C02934000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3017727475.00001B1C02C60000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012373557.00001B1C02E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://addons.avg.com/$
Source: AVGBrowser.exe, 0000001C.00000003.3012102665.00001B1C029B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012296585.00001B1C02E6C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012199682.00001B1C02934000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3017727475.00001B1C02C60000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012373557.00001B1C02E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://addons.avg.securebrowser.com
Source: AVGBrowser.exe, 0000001C.00000003.3012102665.00001B1C029B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012296585.00001B1C02E6C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012199682.00001B1C02934000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3017727475.00001B1C02C60000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012373557.00001B1C02E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://addons.avg.securebrowser.com1)https://addons.ccleaner.securebrowser.com.&https://addons.avir
Source: AVGBrowser.exe, 0000001C.00000003.3012102665.00001B1C029B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012296585.00001B1C02E6C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012199682.00001B1C02934000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3017727475.00001B1C02C60000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012373557.00001B1C02E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://addons.avira.securebrowser.com
Source: AVGBrowser.exe, 0000001C.00000003.3012102665.00001B1C029B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012296585.00001B1C02E6C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012199682.00001B1C02934000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3017727475.00001B1C02C60000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012373557.00001B1C02E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://addons.ccleaner.com/
Source: AVGBrowser.exe, 0000001C.00000003.3012102665.00001B1C029B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012296585.00001B1C02E6C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012199682.00001B1C02934000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3017727475.00001B1C02C60000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012373557.00001B1C02E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://addons.ccleaner.com/.&https://addons.avast.securebrowser.com
Source: AVGBrowser.exe, 0000001C.00000003.3012102665.00001B1C029B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012296585.00001B1C02E6C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012199682.00001B1C02934000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3017727475.00001B1C02C60000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012373557.00001B1C02E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://addons.ccleaner.securebrowser.com
Source: AVGBrowser.exe, 0000001C.00000003.3012102665.00001B1C029B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012296585.00001B1C02E6C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012199682.00001B1C02934000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3017727475.00001B1C02C60000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012373557.00001B1C02E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://addons.norton.securebrowser.com
Source: AVGBrowser.exe, 0000001C.00000003.3012102665.00001B1C029B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012296585.00001B1C02E6C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012199682.00001B1C02934000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3017727475.00001B1C02C60000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012373557.00001B1C02E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://addons.norton.securebrowser.com1)https://test-browser-addons.svc.avast.comQIDiscover
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/4830
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/4966
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/5845
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/6574
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7161
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7162
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7246
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7308
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7319
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7320
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7369
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7382
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7489
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7604
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7714
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7847
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7899
Source: AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/8417
Source: AVGBrowser.exe, 0000001C.00000003.3013268260.00001B1C024A8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3013020019.00001B1C0249C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987281454.00000FDC024B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987561449.00000FDC024BC000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.3013972187.00000FDC024C4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987608916.00000FDC024C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://auth-browser-sync.svc.avast.com/auth/token
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beta-config.avast.securebrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beta-config.avg.securebrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beta-config.avira.securebrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beta-config.ccleaner.securebrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beta-config.norton.securebrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beta-content.securebrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beta-engagement-content.avastbrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beta-onboarding.avast.securebrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beta-onboarding.avg.securebrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beta-onboarding.avira.securebrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beta-onboarding.ccleaner.securebrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beta-onboarding.norton.securebrowser.com
Source: AVGBrowser.exe, 0000001C.00000003.2981624358.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011651551.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2926044433.00000FDC00F52000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/search
Source: AVGBrowser.exe, 0000001C.00000003.3012373557.00001B1C02E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore
Source: ajF04F.exe, 00000003.00000003.2098910133.00000000007B8000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2075467453.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2074644451.00000000007A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crx
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://config.avast.securebrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://config.avg.securebrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://config.avira.securebrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://config.ccleaner.securebrowser.com
Source: AVGBrowser.exe, 0000001C.00000003.3007093988.00001B1C02DA0000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.2999861869.00001B1C02940000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3004396509.00001B1C02D94000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986082293.00000FDC02D38000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2985890198.00000FDC02D7C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://config.norton.securebrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://config.norton.securebrowser.com;
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://content.securebrowser.com
Source: setup.exe, 00000017.00000002.2873586684.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, setup.exe, 00000017.00000000.2539988971.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, setup.exe, 00000018.00000002.2876710388.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, setup.exe, 00000018.00000000.2544840578.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, AVGBrowser.exe, 0000001A.00000000.2869521627.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001B.00000000.2872124493.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001C.00000000.2875770965.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001D.00000000.2876092036.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001E.00000000.2878831708.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001F.00000002.2896650039.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001F.00000000.2879064714.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpString found in binary or memory: https://crashpad.chromium.org/
Source: setup.exe, 00000017.00000002.2873586684.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, setup.exe, 00000017.00000000.2539988971.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, setup.exe, 00000018.00000002.2876710388.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, setup.exe, 00000018.00000000.2544840578.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, AVGBrowser.exe, 0000001A.00000000.2869521627.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001B.00000000.2872124493.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001C.00000000.2875770965.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001D.00000000.2876092036.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001E.00000000.2878831708.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001F.00000002.2896650039.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001F.00000000.2879064714.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpString found in binary or memory: https://crashpad.chromium.org/bug/new
Source: setup.exe, 00000017.00000002.2873586684.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, setup.exe, 00000017.00000000.2539988971.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, setup.exe, 00000018.00000002.2876710388.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, setup.exe, 00000018.00000000.2544840578.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, AVGBrowser.exe, 0000001A.00000000.2869521627.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001B.00000000.2872124493.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001C.00000000.2875770965.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001D.00000000.2876092036.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001E.00000000.2878831708.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001F.00000002.2896650039.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001F.00000000.2879064714.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpString found in binary or memory: https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new
Source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/cps0%
Source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/rpa0
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://dev-config.avast.securebrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://dev-config.avg.securebrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://dev-config.avira.securebrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://dev-config.ccleaner.securebrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://dev-config.norton.securebrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://dev-content.securebrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://dev-engagement-content.avastbrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://dev-onboarding.avast.securebrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://dev-onboarding.avg.securebrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://dev-onboarding.avira.securebrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://dev-onboarding.ccleaner.securebrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://dev-onboarding.norton.securebrowser.com
Source: ajF04F.exe, 00000003.00000003.2074644451.00000000007A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/
Source: ajF04F.exe, 00000003.00000003.2074644451.00000000007A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-autopush.corp.google.com/
Source: ajF04F.exe, 00000003.00000003.2074644451.00000000007A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-0.corp.google.com/
Source: ajF04F.exe, 00000003.00000003.2074644451.00000000007A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-1.corp.google.com/
Source: ajF04F.exe, 00000003.00000003.2074644451.00000000007A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-2.corp.google.com/
Source: ajF04F.exe, 00000003.00000003.2074644451.00000000007A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-3.corp.google.com/
Source: ajF04F.exe, 00000003.00000003.2074644451.00000000007A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-4.corp.google.com/
Source: ajF04F.exe, 00000003.00000003.2074644451.00000000007A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-5.corp.google.com/
Source: ajF04F.exe, 00000003.00000003.2074644451.00000000007A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-6.corp.google.com/
Source: ajF04F.exe, 00000003.00000003.2074644451.00000000007A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-preprod.corp.google.com/
Source: ajF04F.exe, 00000003.00000003.2074644451.00000000007A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-staging.corp.google.com/
Source: ajF04F.exe, 00000003.00000003.2074644451.00000000007A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/
Source: AVGBrowser.exe, 0000001C.00000003.2981624358.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011651551.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://easylist-downloads.adblockplus.org/abp-filters-anti-cv.txt
Source: AVGBrowser.exe, 0000001C.00000003.2981624358.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011651551.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://easylist-downloads.adblockplus.org/abp-filters-anti-cv.txtt
Source: AVGBrowser.exe, 0000001C.00000003.2981624358.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011651551.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://easylist-downloads.adblockplus.org/abp-filters-anti-cv.txttxt
Source: AVGBrowser.exe, 0000001C.00000003.2981624358.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3047052872.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011651551.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://easylist-downloads.adblockplus.org/abpindo
Source: AVGBrowser.exe, 0000001C.00000003.3047052872.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011651551.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://easylist-downloads.adblockplus.org/abpvn
Source: AVGBrowser.exe, 0000001D.00000003.2950597680.00000FDC029A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://easylist-downloads.adblockplus.org/dandelion_sprouts_nordic_filters
Source: AVGBrowser.exe, 0000001C.00000003.3047052872.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011651551.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://easylist-downloads.adblockplus.org/easylist.txt
Source: AVGBrowser.exe, 0000001C.00000003.3047052872.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011651551.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://easylist-downloads.adblockplus.org/exceptionrules.txt
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://engagement-content.avastbrowser.com
Source: AVGBrowser.exe, 0000001C.00000003.3046330607.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011991588.00001B1C02E30000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986448715.00000FDC02E0C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://engagement-content.avastbrowser.com/79014/pg_indicator_on_light.svg
Source: AVGBrowser.exe, 0000001C.00000003.3046330607.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011991588.00001B1C02E30000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986448715.00000FDC02E0C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://engagement-content.avastbrowser.com/79015/pg_indicator_on_dark.svg
Source: AVGBrowser.exe, 0000001C.00000003.3046330607.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011991588.00001B1C02E30000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3027804980.00001B1C029E4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986448715.00000FDC02E0C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.3045716415.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://engagement-content.avastbrowser.com/79016/spc_light.svg
Source: AVGBrowser.exe, 0000001C.00000003.3046330607.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011991588.00001B1C02E30000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3027804980.00001B1C029E4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986448715.00000FDC02E0C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.3045716415.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://engagement-content.avastbrowser.com/79017/spc_dark.svg
Source: AVGBrowser.exe, 0000001D.00000003.3045716415.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://engagement-content.avastbrowser.com/84600/icon_avast.svg
Source: AVGBrowser.exe, 0000001D.00000003.3045716415.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://engagement-content.avastbrowser.com/94047/illustration.svg
Source: AVGBrowser.exe, 0000001C.00000003.3011651551.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://engagement-content.avastbrowser.com/94047/illustration.svgor
Source: AVGBrowser.exe, 0000001D.00000003.3045716415.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://engagement-content.avastbrowser.com/94055/illustration-3.svg
Source: AVGBrowser.exe, 0000001D.00000003.3045716415.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://engagement-content.avastbrowser.com/94624/icon_norton.svg
Source: AVGBrowser.exe, 0000001D.00000003.3045716415.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://engagement-content.avastbrowser.com/94625/icon_avira.svg
Source: AVGBrowser.exe, 0000001D.00000003.3045716415.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://engagement-content.avastbrowser.com/94626/icon_avg.png
Source: AVGBrowser.exe, 0000001D.00000003.3045716415.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://engagement-content.avastbrowser.com/94627/icon_ccleaner.png
Source: AVGBrowser.exe, 0000001C.00000003.3046330607.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011991588.00001B1C02E30000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3027804980.00001B1C029E4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986448715.00000FDC02E0C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.3045716415.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://engagement-content.avastbrowser.com/95232/Coupon.svg
Source: svchost.exe, 00000002.00000003.2032432628.000001B642C73000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000002.00000003.2032432628.000001B642C00000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: AVGBrowser.exe, 0000001C.00000003.3047803586.00001B1C02AD0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gemini.google.com/app?q=
Source: AVGBrowser.exe, 0000001C.00000003.3012851459.00001B1C024C0000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012804820.00001B1C024BC000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012959395.00001B1C024C4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986500277.00000FDC024D8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986938270.00000FDC024E0000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986714551.00000FDC024DC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://id.avast.com/
Source: AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/155487768
Source: AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/161903006
Source: AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/166809097
Source: AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/184850002
Source: AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/187425444
Source: AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/220069903
Source: AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/229267970
Source: AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/250706693
Source: AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/253522366
Source: AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/255411748
Source: AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/258207403
Source: AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/274859104
Source: AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/284462263
Source: AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/288119108
Source: AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/292282210
Source: AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/292285899
Source: AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/309028728
Source: AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/315836169
Source: AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/328837151
Source: AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: ajF04F.exe, 00000003.00000003.2075467453.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2074644451.00000000007A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: ajF04F.exe, 00000003.00000003.2075467453.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2074644451.00000000007A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: ajF04F.exe, 00000003.00000003.2074644451.00000000007A8000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2075467453.00000000007DC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: AVGBrowser.exe, 0000001C.00000003.3013268260.00001B1C024A8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3013020019.00001B1C0249C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987281454.00000FDC024B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987561449.00000FDC024BC000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.3013972187.00000FDC024C4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2987608916.00000FDC024C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://onboarding.avast.securebrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://onboarding.avg.securebrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://onboarding.avira.securebrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://onboarding.ccleaner.securebrowser.com
Source: AVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://onboarding.norton.securebrowser.com
Source: AVGBrowser.exe, 0000001C.00000003.3000072043.00001B1C02D40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://search.yahoo.com/yhs/search
Source: setup.exe, 00000017.00000002.2873586684.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, setup.exe, 00000017.00000000.2539988971.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, setup.exe, 00000018.00000002.2876710388.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, setup.exe, 00000018.00000000.2544840578.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpString found in binary or memory: https://somewhereopenSystem32windirexploreEnabled://somewhereSHCore.dllSYSTEM32windirsetup_helper_sy
Source: ajF04F.exe, 00000003.00000003.2099462467.000000000395A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stats.securebrowser.com/
Source: ajF04F.exe, 00000003.00000003.2099462467.000000000395A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stats.securebrowser.com/?_=1717427700642&retry_tracking_count=0&last_request_error_code=0&la
Source: ajF04F.exe, 00000003.00000003.2099462467.000000000395A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stats.securebrowser.com/N
Source: AVGBrowser.exe, 0000001C.00000003.3046330607.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011991588.00001B1C02E30000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3027804980.00001B1C029E4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986448715.00000FDC02E0C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.3045716415.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://support.avast.com/en-us/article/secure-browser-faq
Source: AVGBrowser.exe, 0000001C.00000003.3046330607.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011991588.00001B1C02E30000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3027804980.00001B1C029E4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986448715.00000FDC02E0C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.3045716415.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://support.avg.com/SupportArticleView?l=en&urlName=avg-secure-browser-faq&q=coupons&supportType
Source: AVGBrowser.exe, 0000001C.00000003.3046330607.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011991588.00001B1C02E30000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3027804980.00001B1C029E4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986448715.00000FDC02E0C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.3045716415.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://support.avira.com/hc/en-us/articles/13707860217233
Source: AVGBrowser.exe, 0000001C.00000003.3046330607.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011991588.00001B1C02E30000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3027804980.00001B1C029E4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986448715.00000FDC02E0C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.3045716415.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://support.norton.com/sp/en/us/home/current/solutions/v2023031322263778
Source: AVGBrowser.exe, 0000001C.00000003.3012102665.00001B1C029B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012296585.00001B1C02E6C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012199682.00001B1C02934000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3017727475.00001B1C02C60000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012373557.00001B1C02E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://test-browser-addons.svc.avast.com
Source: AVGBrowserUpdate.exe, 00000010.00000003.2242142015.0000000000CAB000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000010.00000002.2244872340.0000000000CAB000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000002.2897358431.0000000001571000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000003.2889037888.0000000001571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://update.avgbrowser.com/
Source: AVGBrowserUpdate.exe, 0000000D.00000002.2285893864.0000000000D5C000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 0000000D.00000003.2281016026.0000000000D5C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://update.avgbrowser.com/V
Source: AVGBrowser.exe, 0000001C.00000003.2981624358.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3047052872.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011651551.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://update.avgbrowser.com/adblock/assets/v3/document_whitelist.txt
Source: AVGBrowser.exe, 0000001C.00000003.2981624358.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011651551.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://update.avgbrowser.com/adblock/assets/v3/document_whitelist.txtblink.mojom.WidgetInputHandler
Source: AVGBrowser.exe, 0000001C.00000003.2981624358.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3047052872.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011651551.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://update.avgbrowser.com/adblock/assets/v3/filter_whitelist.txt
Source: AVGBrowser.exe, 0000001C.00000003.2981624358.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011651551.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://update.avgbrowser.com/adblock/assets/v3/filter_whitelist.txtt
Source: AVGBrowserUpdate.exe, 00000010.00000002.2244872340.0000000000CC0000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000010.00000003.2243791317.0000000000CCD000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000003.2889037888.00000000015A7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://update.avgbrowser.com/service/update2
Source: AVGBrowserUpdate.exe, 00000012.00000003.2891305776.0000000001537000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000003.2895370553.0000000001537000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000002.2897153726.0000000001537000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://update.avgbrowser.com/service/update27
Source: AVGBrowserUpdate.exe, 00000012.00000003.2895005428.000000000159E000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000003.2891305776.0000000001537000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000002.2897358431.0000000001571000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000003.2895370553.0000000001537000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000003.2892228142.000000000159C000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000002.2897153726.0000000001537000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000003.2889037888.0000000001571000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000002.2897780593.00000000015A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://update.avgbrowser.com/service/update2?cup2key=9:1470396613&cup2hreq=9946070338cefa8ad493aa8c
Source: AVGBrowserUpdate.exe, 0000000D.00000002.2284690621.0000000000D25000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://update.avgbrowser.com/service/update2s
Source: AVGBrowserUpdate.exe, 00000010.00000003.2242142015.0000000000CC0000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000010.00000002.2244872340.0000000000CC0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://update.avgbrowser.com/service/update2~
Source: AVGBrowserUpdate.exe, 00000010.00000002.2244635331.0000000000C69000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://update.avgbrowser.com:443/service/update2
Source: AVGBrowserUpdate.exe, 0000000D.00000002.2284690621.0000000000CD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://update.avgbrowser.com:443/service/update2serUpdate.exe
Source: AVGBrowser.exe, 0000001C.00000003.3047803586.00001B1C02AD0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.
Source: ajF04F.exe, 00000003.00000003.2074644451.00000000007A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/
Source: AVGBrowser.exe, 0000001C.00000003.2981624358.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011651551.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: AVGBrowser.exe, 0000001D.00000003.2931251986.00000FDC00276000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/search?q=&
Source: AVGBrowser.exe, 0000001C.00000003.3046330607.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011991588.00001B1C02E30000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986448715.00000FDC02E0C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.startpage.com/en/how-startpage-works
Source: AVGBrowser.exe, 0000001C.00000003.2981624358.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011651551.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.startpage.com/sp/cdn/images/startpage-logo-new.svg
Source: AVGBrowser.exe, 0000001C.00000003.3000072043.00001B1C02D40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.yahoo.com/favicon.icohttps://ch.search.yahoo.com/yhs/search
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B1C148 lstrlenW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,9_2_00007FF677B1C148
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B1C148 lstrlenW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,9_2_00007FF677B1C148

System Summary

barindex
Malicious sample detected (through community Yara rule)
Source: 4.3.AVGBrowserUpdateSetup.exe.34af14c.173.raw.unpack, type: UNPACKEDPEMatched rule: PlugX Identifying Strings Author: Seth Hardy
Source: 4.3.AVGBrowserUpdateSetup.exe.348a40c.135.raw.unpack, type: UNPACKEDPEMatched rule: PlugX Identifying Strings Author: Seth Hardy
Source: 4.3.AVGBrowserUpdateSetup.exe.3e64620.92.raw.unpack, type: UNPACKEDPEMatched rule: PlugX Identifying Strings Author: Seth Hardy
Source: 4.3.AVGBrowserUpdateSetup.exe.2c7340c.48.raw.unpack, type: UNPACKEDPEMatched rule: PlugX Identifying Strings Author: Seth Hardy
Source: 4.3.AVGBrowserUpdateSetup.exe.2cbce88.51.raw.unpack, type: UNPACKEDPEMatched rule: PlugX Identifying Strings Author: Seth Hardy
Source: 4.3.AVGBrowserUpdateSetup.exe.34d3e88.127.raw.unpack, type: UNPACKEDPEMatched rule: PlugX Identifying Strings Author: Seth Hardy
Source: 4.3.AVGBrowserUpdateSetup.exe.3e3e420.89.raw.unpack, type: UNPACKEDPEMatched rule: PlugX Identifying Strings Author: Seth Hardy
Source: 4.3.AVGBrowserUpdateSetup.exe.3e18220.102.raw.unpack, type: UNPACKEDPEMatched rule: PlugX Identifying Strings Author: Seth Hardy
Source: 4.3.AVGBrowserUpdateSetup.exe.2c9814c.26.raw.unpack, type: UNPACKEDPEMatched rule: PlugX Identifying Strings Author: Seth Hardy
Source: 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: PlugX Identifying Strings Author: Seth Hardy
Source: 00000004.00000003.2112481989.0000000002C6C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: PlugX Identifying Strings Author: Seth Hardy
Source: 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: PlugX Identifying Strings Author: Seth Hardy
Source: Process Memory Space: AVGBrowserUpdateSetup.exe PID: 1576, type: MEMORYSTRMatched rule: PlugX Identifying Strings Author: Seth Hardy
Source: Process Memory Space: AVGBrowserUpdate.exe PID: 3116, type: MEMORYSTRMatched rule: PlugX Identifying Strings Author: Seth Hardy
Source: Process Memory Space: AVGBrowserUpdateComRegisterShell64.exe PID: 6580, type: MEMORYSTRMatched rule: PlugX Identifying Strings Author: Seth Hardy
Source: Process Memory Space: AVGBrowserUpdateComRegisterShell64.exe PID: 2636, type: MEMORYSTRMatched rule: PlugX Identifying Strings Author: Seth Hardy
Source: Process Memory Space: AVGBrowserUpdateComRegisterShell64.exe PID: 5016, type: MEMORYSTRMatched rule: PlugX Identifying Strings Author: Seth Hardy
Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmpJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Caches
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\5d2f0a.msi
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\inprogressinstallinfo.ipi
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\SourceHash{EDB7AEE7-E932-4836-AE50-D3B0B7766CB5}
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI32A4.tmp
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\5d2f0d.msi
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\5d2f0d.msi
Source: C:\Windows\System32\msiexec.exeFile deleted: C:\Windows\Installer\5d2f0d.msi
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeCode function: 4_2_00B25CAB4_2_00B25CAB
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeCode function: 4_2_00B1A8D44_2_00B1A8D4
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeCode function: 4_2_00B224384_2_00B22438
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeCode function: 4_2_00B1F9314_2_00B1F931
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeCode function: 4_2_00B21FB04_2_00B21FB0
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeCode function: 4_2_00B1432C4_2_00B1432C
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeCode function: 5_2_00A73BBB5_2_00A73BBB
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeCode function: 6_2_00083BBB6_2_00083BBB
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B4D90C9_2_00007FF677B4D90C
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B270E09_2_00007FF677B270E0
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B3A8A89_2_00007FF677B3A8A8
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B3B0509_2_00007FF677B3B050
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B4F0149_2_00007FF677B4F014
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B40FD09_2_00007FF677B40FD0
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B4B7E09_2_00007FF677B4B7E0
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B477B09_2_00007FF677B477B0
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B307B49_2_00007FF677B307B4
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B4971C9_2_00007FF677B4971C
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B4D6909_2_00007FF677B4D690
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B266449_2_00007FF677B26644
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B256549_2_00007FF677B25654
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B3AE649_2_00007FF677B3AE64
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B50D989_2_00007FF677B50D98
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B1E5AC9_2_00007FF677B1E5AC
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B3FD549_2_00007FF677B3FD54
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B3CD109_2_00007FF677B3CD10
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B414C89_2_00007FF677B414C8
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B3BCE49_2_00007FF677B3BCE4
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B3AC7C9_2_00007FF677B3AC7C
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B4ACB09_2_00007FF677B4ACB0
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B544649_2_00007FF677B54464
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B433E09_2_00007FF677B433E0
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B283E89_2_00007FF677B283E8
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B303889_2_00007FF677B30388
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B523609_2_00007FF677B52360
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B54B689_2_00007FF677B54B68
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B43ACA9_2_00007FF677B43ACA
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B48A889_2_00007FF677B48A88
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B3AA909_2_00007FF677B3AA90
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B2DAB49_2_00007FF677B2DAB4
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B3B2389_2_00007FF677B3B238
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B4E2149_2_00007FF677B4E214
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B3C9449_2_00007FF677B3C944
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B4915C9_2_00007FF677B4915C
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B4B1609_2_00007FF677B4B160
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\AVGBrowserInstaller.exeCode function: 20_2_00007FF73BED12C020_2_00007FF73BED12C0
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 23_2_00007FF60158BC4023_2_00007FF60158BC40
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 23_2_00007FF60158CE5023_2_00007FF60158CE50
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 23_2_00007FF60158B90023_2_00007FF60158B900
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 23_2_00007FF60165CB1023_2_00007FF60165CB10
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 23_2_00007FF601583D1023_2_00007FF601583D10
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 23_2_00007FF6015838E023_2_00007FF6015838E0
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 23_2_00007FF60158AEC023_2_00007FF60158AEC0
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 23_2_00007FF60158DEC023_2_00007FF60158DEC0
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 23_2_00007FF60158378023_2_00007FF601583780
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 23_2_00007FF60158A56023_2_00007FF60158A560
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 23_2_00007FF60158176023_2_00007FF601581760
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 23_2_00007FF601581D6023_2_00007FF601581D60
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 23_2_00007FF60158BB7223_2_00007FF60158BB72
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 23_2_00007FF601583B7023_2_00007FF601583B70
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 23_2_00007FF60158A82023_2_00007FF60158A820
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 23_2_00007FF60158CC2823_2_00007FF60158CC28
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 23_2_00007FF6016C560C23_2_00007FF6016C560C
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 23_2_00007FF6015859E023_2_00007FF6015859E0
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 23_2_00007FF601582FE023_2_00007FF601582FE0
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 23_2_00007FF6015825D023_2_00007FF6015825D0
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 24_2_00007FF60158BC4024_2_00007FF60158BC40
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 24_2_00007FF60158CE5024_2_00007FF60158CE50
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 24_2_00007FF60158B90024_2_00007FF60158B900
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 24_2_00007FF60165CB1024_2_00007FF60165CB10
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 24_2_00007FF601583D1024_2_00007FF601583D10
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 24_2_00007FF6015838E024_2_00007FF6015838E0
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 24_2_00007FF60158AEC024_2_00007FF60158AEC0
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 24_2_00007FF60158DEC024_2_00007FF60158DEC0
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 24_2_00007FF60158378024_2_00007FF601583780
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 24_2_00007FF60158A56024_2_00007FF60158A560
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 24_2_00007FF60158176024_2_00007FF601581760
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 24_2_00007FF601581D6024_2_00007FF601581D60
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 24_2_00007FF60158BB7224_2_00007FF60158BB72
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 24_2_00007FF601583B7024_2_00007FF601583B70
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 24_2_00007FF60158A82024_2_00007FF60158A820
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 24_2_00007FF60158CC2824_2_00007FF60158CC28
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 24_2_00007FF6016C560C24_2_00007FF6016C560C
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 24_2_00007FF6015859E024_2_00007FF6015859E0
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 24_2_00007FF601582FE024_2_00007FF601582FE0
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 24_2_00007FF6015825D024_2_00007FF6015825D0
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF691048A4C30_2_00007FF691048A4C
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690F0824030_2_00007FF690F08240
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690F1D28030_2_00007FF690F1D280
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690FB529030_2_00007FF690FB5290
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690EFE9C030_2_00007FF690EFE9C0
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690F712C030_2_00007FF690F712C0
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690FD1AD030_2_00007FF690FD1AD0
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690F1EAD030_2_00007FF690F1EAD0
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690FB7B1030_2_00007FF690FB7B10
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690F03B3030_2_00007FF690F03B30
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690FE596030_2_00007FF690FE5960
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690FF517030_2_00007FF690FF5170
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690FEE18030_2_00007FF690FEE180
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690F601D030_2_00007FF690F601D0
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF69101149030_2_00007FF691011490
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF69103AC8430_2_00007FF69103AC84
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690EF1BD030_2_00007FF690EF1BD0
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690F02BB330_2_00007FF690F02BB3
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690F194D030_2_00007FF690F194D0
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690EFCB6030_2_00007FF690EFCB60
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF6910ABD3030_2_00007FF6910ABD30
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690FB3D3030_2_00007FF690FB3D30
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690F0152030_2_00007FF690F01520
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF6910AC37030_2_00007FF6910AC370
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690F3637030_2_00007FF690F36370
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690FE93B030_2_00007FF690FE93B0
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF6910243F030_2_00007FF6910243F0
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF6910A5C1030_2_00007FF6910A5C10
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690F3EE4030_2_00007FF690F3EE40
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF69103AE8830_2_00007FF69103AE88
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF69109068030_2_00007FF691090680
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF691046EB030_2_00007FF691046EB0
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690FBF72030_2_00007FF690FBF720
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690F37F3030_2_00007FF690F37F30
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690F8CD4030_2_00007FF690F8CD40
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690FF7D7030_2_00007FF690FF7D70
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF69101B5F030_2_00007FF69101B5F0
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF69103B08C30_2_00007FF69103B08C
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF6910A58C030_2_00007FF6910A58C0
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690F1D92030_2_00007FF690F1D920
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690FB577030_2_00007FF690FB5770
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF6910A3FF030_2_00007FF6910A3FF0
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF6910AC7E030_2_00007FF6910AC7E0
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF6910167E030_2_00007FF6910167E0
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exeCode function: 32_2_0077C40B32_2_0077C40B
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exeCode function: 33_2_00007FF60BFD59E433_2_00007FF60BFD59E4
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exeCode function: 33_2_00007FF60BFDCEF833_2_00007FF60BFDCEF8
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exeCode function: 33_2_00007FF60BFD6F4C33_2_00007FF60BFD6F4C
Source: C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exeCode function: 36_2_00007FF76861378036_2_00007FF768613780
Source: C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exeCode function: 36_2_00007FF768613B7036_2_00007FF768613B70
Source: C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exeCode function: 36_2_00007FF76861BB7236_2_00007FF76861BB72
Source: C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exeCode function: 36_2_00007FF76861A56036_2_00007FF76861A560
Source: C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exeCode function: 36_2_00007FF76861176036_2_00007FF768611760
Source: C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exeCode function: 36_2_00007FF768611D6036_2_00007FF768611D60
Source: C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exeCode function: 36_2_00007FF768612FE036_2_00007FF768612FE0
Source: C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exeCode function: 36_2_00007FF7686159E036_2_00007FF7686159E0
Source: C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exeCode function: 36_2_00007FF7686125D036_2_00007FF7686125D0
Source: C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exeCode function: 36_2_00007FF76861CE5036_2_00007FF76861CE50
Source: C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exeCode function: 36_2_00007FF76861BC4036_2_00007FF76861BC40
Source: C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exeCode function: 36_2_00007FF76861CC2836_2_00007FF76861CC28
Source: C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exeCode function: 36_2_00007FF76861A82036_2_00007FF76861A820
Source: C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exeCode function: 36_2_00007FF768613D1036_2_00007FF768613D10
Source: C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exeCode function: 36_2_00007FF76861B90036_2_00007FF76861B900
Source: C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exeCode function: 36_2_00007FF7686138E036_2_00007FF7686138E0
Source: C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exeCode function: 36_2_00007FF76861AEC036_2_00007FF76861AEC0
Source: C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exeCode function: 36_2_00007FF76861DEC036_2_00007FF76861DEC0
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: String function: 00007FF677B1A990 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeCode function: String function: 00B157E0 appears 33 times
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeCode function: String function: 00077F50 appears 33 times
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeCode function: String function: 00A67F50 appears 33 times
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exeCode function: String function: 00771940 appears 33 times
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: String function: 00007FF69106D940 appears 197 times
Source: file.exeStatic PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary
Source: sciterui.dll.0.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: ajF04F.exe.0.drStatic PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary
Source: AVGBrowserUninstall.exe.3.drStatic PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary
Source: sciterui.dll.3.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: goopdateres_vi.dll.4.drStatic PE information: Resource name: RT_STRING type: iAPX 286 executable small model (COFF) not stripped
Source: goopdateres_ca.dll.4.drStatic PE information: Resource name: RT_STRING type: MIPSEB-LE MIPS-II ECOFF executable not stripped - version 0.114
Source: goopdateres_fil.dll.4.drStatic PE information: Resource name: RT_STRING type: VAX COFF executable, sections 80, created Wed Mar 25 10:31:05 1970, not stripped, version 108
Source: goopdateres_hu.dll.4.drStatic PE information: Resource name: RT_STRING type: MIPSEL MIPS-II ECOFF executable not stripped - version 0.101
Source: goopdateres_ms.dll.4.drStatic PE information: Resource name: RT_STRING type: 370 sysV executable not stripped
Source: goopdateres_th.dll.4.drStatic PE information: Resource name: RT_STRING type: PDP-11 overlaid pure executable not stripped
Source: goopdateres_tr.dll.4.drStatic PE information: Resource name: RT_STRING type: 370 XA sysV pure executable not stripped
Source: goopdateres_ca.dll.5.drStatic PE information: Resource name: RT_STRING type: MIPSEB-LE MIPS-II ECOFF executable not stripped - version 0.114
Source: goopdateres_fil.dll.5.drStatic PE information: Resource name: RT_STRING type: VAX COFF executable, sections 80, created Wed Mar 25 10:31:05 1970, not stripped, version 108
Source: goopdateres_hu.dll.5.drStatic PE information: Resource name: RT_STRING type: MIPSEL MIPS-II ECOFF executable not stripped - version 0.101
Source: file.exeStatic PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary
Source: ajF04F.exe.0.drStatic PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary
Source: AVGBrowserUninstall.exe.3.drStatic PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary
Source: sciterui.dll.3.drStatic PE information: No import functions for PE file found
Source: sciterui.dll.0.drStatic PE information: No import functions for PE file found
Source: file.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: 4.3.AVGBrowserUpdateSetup.exe.34af14c.173.raw.unpack, type: UNPACKEDPEMatched rule: PlugXStrings author = Seth Hardy, description = PlugX Identifying Strings, last_modified = 2014-06-12
Source: 4.3.AVGBrowserUpdateSetup.exe.348a40c.135.raw.unpack, type: UNPACKEDPEMatched rule: PlugXStrings author = Seth Hardy, description = PlugX Identifying Strings, last_modified = 2014-06-12
Source: 4.3.AVGBrowserUpdateSetup.exe.3e64620.92.raw.unpack, type: UNPACKEDPEMatched rule: PlugXStrings author = Seth Hardy, description = PlugX Identifying Strings, last_modified = 2014-06-12
Source: 4.3.AVGBrowserUpdateSetup.exe.2c7340c.48.raw.unpack, type: UNPACKEDPEMatched rule: PlugXStrings author = Seth Hardy, description = PlugX Identifying Strings, last_modified = 2014-06-12
Source: 4.3.AVGBrowserUpdateSetup.exe.2cbce88.51.raw.unpack, type: UNPACKEDPEMatched rule: PlugXStrings author = Seth Hardy, description = PlugX Identifying Strings, last_modified = 2014-06-12
Source: 4.3.AVGBrowserUpdateSetup.exe.34d3e88.127.raw.unpack, type: UNPACKEDPEMatched rule: PlugXStrings author = Seth Hardy, description = PlugX Identifying Strings, last_modified = 2014-06-12
Source: 4.3.AVGBrowserUpdateSetup.exe.3e3e420.89.raw.unpack, type: UNPACKEDPEMatched rule: PlugXStrings author = Seth Hardy, description = PlugX Identifying Strings, last_modified = 2014-06-12
Source: 4.3.AVGBrowserUpdateSetup.exe.3e18220.102.raw.unpack, type: UNPACKEDPEMatched rule: PlugXStrings author = Seth Hardy, description = PlugX Identifying Strings, last_modified = 2014-06-12
Source: 4.3.AVGBrowserUpdateSetup.exe.2c9814c.26.raw.unpack, type: UNPACKEDPEMatched rule: PlugXStrings author = Seth Hardy, description = PlugX Identifying Strings, last_modified = 2014-06-12
Source: 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: PlugXStrings author = Seth Hardy, description = PlugX Identifying Strings, last_modified = 2014-06-12
Source: 00000004.00000003.2112481989.0000000002C6C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: PlugXStrings author = Seth Hardy, description = PlugX Identifying Strings, last_modified = 2014-06-12
Source: 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: PlugXStrings author = Seth Hardy, description = PlugX Identifying Strings, last_modified = 2014-06-12
Source: Process Memory Space: AVGBrowserUpdateSetup.exe PID: 1576, type: MEMORYSTRMatched rule: PlugXStrings author = Seth Hardy, description = PlugX Identifying Strings, last_modified = 2014-06-12
Source: Process Memory Space: AVGBrowserUpdate.exe PID: 3116, type: MEMORYSTRMatched rule: PlugXStrings author = Seth Hardy, description = PlugX Identifying Strings, last_modified = 2014-06-12
Source: Process Memory Space: AVGBrowserUpdateComRegisterShell64.exe PID: 6580, type: MEMORYSTRMatched rule: PlugXStrings author = Seth Hardy, description = PlugX Identifying Strings, last_modified = 2014-06-12
Source: Process Memory Space: AVGBrowserUpdateComRegisterShell64.exe PID: 2636, type: MEMORYSTRMatched rule: PlugXStrings author = Seth Hardy, description = PlugX Identifying Strings, last_modified = 2014-06-12
Source: Process Memory Space: AVGBrowserUpdateComRegisterShell64.exe PID: 5016, type: MEMORYSTRMatched rule: PlugXStrings author = Seth Hardy, description = PlugX Identifying Strings, last_modified = 2014-06-12
Source: classification engineClassification label: mal40.spyw.evad.winEXE@82/560@0/6
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeCode function: 4_2_00B12E59 GetLastError,GetLastError,SetLastError,SetLastError,FormatMessageW,GetLastError,SetLastError,LocalFree,4_2_00B12E59
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeCode function: 4_2_00B11ECD GetTempFileNameW,FindResourceW,LoadResource,LockResource,CreateFileW,SizeofResource,SetFilePointerEx,CloseHandle,4_2_00B11ECD
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile created: C:\Program Files\AVG\Browser\AVGBrowserUninstall.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile created: C:\Users\user\AppData\Local\AVGJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeMutant created: \BaseNamedObjects\Global\AVGBrowserUpdate{D0BB2EF1-C183-4cdb-B218-040922092869}
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeMutant created: \Sessions\1\BaseNamedObjects\avg-securebrowser_installer_mutex2
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeMutant created: NULL
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeMutant created: \BaseNamedObjects\Global\AVGBrowserUpdate{66CC0160-ABB3-4066-AE47-1CA6AD5065C8}
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeMutant created: \BaseNamedObjects\Global\AVGBrowserUpdate{A9A86B93-B54E-4570-BE89-42418507707B}
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeMutant created: \Sessions\1\BaseNamedObjects\Global\AVGBrowserUpdate{A9A86B93-B54E-4570-BE89-42418507707B}
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeMutant created: \BaseNamedObjects\Global\AVGBrowserUpdate{C68009EA-1163-4498-8E93-D5C4E317D8CE}
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeMutant created: \BaseNamedObjects\Global\AVGBrowserUpdate{0A175FBE-AEEC-4fea-855A-2AA549A88846}
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeMutant created: \Sessions\1\BaseNamedObjects\Global\AVGBrowserUpdate{C68009EA-1163-4498-8E93-D5C4E317D8CE}
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeMutant created: \Sessions\1\BaseNamedObjects\Global\AVGBrowserUpdate{D19BAF17-7C87-467E-8D63-6C4B1C836373}
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeMutant created: \Sessions\1\BaseNamedObjects\Global\ChromeSetupMutex_12217705488491377990
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeMutant created: \BaseNamedObjects\Global\AVGBrowserUpdate{D19BAF17-7C87-467E-8D63-6C4B1C836373}
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeMutant created: \BaseNamedObjects\Global\AVGBrowserUpdate{6885AE8E-C070-458d-9711-37B9BEAB65F6}
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeMutant created: \Sessions\1\BaseNamedObjects\Global\ChromeSetupExitEventMutex_12217705488491377990
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\nsaE38A.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeCommand line argument: kernel32.dll4_2_00B124AD
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeCommand line argument: kernel32.dll5_2_00A66BD8
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeCommand line argument: DllEntry5_2_00A66BD8
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeCommand line argument: kernel32.dll6_2_00076BD8
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeCommand line argument: DllEntry6_2_00076BD8
Source: file.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\file.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\file.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: AVGBrowser.exe, 0000001D.00000003.2985648854.00000FDC02AE8000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: C:\Users\user\Desktop\file.exeFile read: C:\Users\user\Desktop\file.exeJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\AVGBrowserInstaller.exeEvasive API call chain: GetCommandLine,DecisionNodes,ExitProcess
Source: unknownProcess created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Users\user\AppData\Local\Temp\ajF04F.exe "C:\Users\user\AppData\Local\Temp\ajF04F.exe" /relaunch=8 /was_elevated=1 /tagdata
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeProcess created: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe AVGBrowserUpdateSetup.exe /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-GB&brand=9249&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dchrome --import-cookies --auto-launch-chrome"
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeProcess created: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe "C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe" /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-GB&brand=9249&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dchrome --import-cookies --auto-launch-chrome"
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regsvc
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regserver
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"
Source: unknownProcess created: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /c
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"
Source: unknownProcess created: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ua /installsource scheduler
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /registermsihelper
Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTY5My42IiBzaGVsbF92ZXJzaW9uPSIxLjguMTY5My42IiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0iezc2MzdDRkNCLUUwOEQtNDNENC1CMUY3LUMyNERBQjEzQkI4MH0iIGNlcnRfZXhwX2RhdGU9IjIwMjUwOTE3IiB1c2VyaWQ9IntFMUJBQjY4OC1CMDJGLTQ3NDktOUY4OC0zRTFCNEU3REE5OTR9IiB1c2VyaWRfZGF0ZT0iMjAyNDA2MDMiIG1hY2hpbmVpZD0iezAwMDBGOEI1LUM3REUtQTQ4Qy1EMDU4LTA3RTI0NTVCOUE1Qn0iIG1hY2hpbmVpZF9kYXRlPSIyMDI0MDYwMyIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9InsyNTJFNzAzQS1GNkRGLTRBQjYtOTE2MS00NEZENUYwNjYwMER9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDUuMjAwNiIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuOC4xNjkzLjYiIGxhbmc9ImVuLUdCIiBicmFuZD0iOTI0OSIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iNjA2MyIvPjwvYXBwPjwvcmVxdWVzdD4
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /handoff "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-GB&brand=9249&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dchrome --import-cookies --auto-launch-chrome" /installsource otherinstallcmd /sessionid "{7637CFCB-E08D-43D4-B1F7-C24DAB13BB80}" /silent
Source: unknownProcess created: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /uninstall
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\AVGBrowserInstaller.exe "C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\AVGBrowserInstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=chrome --import-cookies --auto-launch-chrome --system-level
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\AVGBrowserInstaller.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe "C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe" --install-archive="C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\SECURE.PACKED.7Z" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=chrome --import-cookies --auto-launch-chrome --system-level
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe "C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=124.0.25069.209 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff60185a3f0,0x7ff60185a3fc,0x7ff60185a408
Source: unknownProcess created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=heartbeat --hourly
Source: unknownProcess created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=heartbeat --logon
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --heartbeat --hourly
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --heartbeat --logon
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\Temp\\Heartbeat8108_647370180 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\Temp\\Heartbeat8108_647370180\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=124.0.25069.209 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8a7b0dc40,0x7ff8a7b0dc4c,0x7ff8a7b0dc58
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\Temp\\Heartbeat8128_116327840 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\Temp\\Heartbeat8128_116327840\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=124.0.25069.209 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8a7b0dc40,0x7ff8a7b0dc4c,0x7ff8a7b0dc58
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2124,i,2166630059599507292,14770330184015614422,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:2
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2028,i,14563547802735666349,826896251076988020,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
Source: unknownProcess created: C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exe "C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exe"
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeProcess created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe AVGBrowser.exe --heartbeat --install --create-profile
Source: unknownProcess created: C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exe "C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exe"
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Users\user\AppData\Local\Temp\ajF04F.exe "C:\Users\user\AppData\Local\Temp\ajF04F.exe" /relaunch=8 /was_elevated=1 /tagdata Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeProcess created: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe AVGBrowserUpdateSetup.exe /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-GB&brand=9249&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dchrome --import-cookies --auto-launch-chrome"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeProcess created: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe "C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe" /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-GB&brand=9249&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dchrome --import-cookies --auto-launch-chrome"Jump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regsvcJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regserverJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTY5My42IiBzaGVsbF92ZXJzaW9uPSIxLjguMTY5My42IiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0iezc2MzdDRkNCLUUwOEQtNDNENC1CMUY3LUMyNERBQjEzQkI4MH0iIGNlcnRfZXhwX2RhdGU9IjIwMjUwOTE3IiB1c2VyaWQ9IntFMUJBQjY4OC1CMDJGLTQ3NDktOUY4OC0zRTFCNEU3REE5OTR9IiB1c2VyaWRfZGF0ZT0iMjAyNDA2MDMiIG1hY2hpbmVpZD0iezAwMDBGOEI1LUM3REUtQTQ4Qy1EMDU4LTA3RTI0NTVCOUE1Qn0iIG1hY2hpbmVpZF9kYXRlPSIyMDI0MDYwMyIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9InsyNTJFNzAzQS1GNkRGLTRBQjYtOTE2MS00NEZENUYwNjYwMER9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDUuMjAwNiIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuOC4xNjkzLjYiIGxhbmc9ImVuLUdCIiBicmFuZD0iOTI0OSIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iNjA2MyIvPjwvYXBwPjwvcmVxdWVzdD4Jump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /handoff "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-GB&brand=9249&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dchrome --import-cookies --auto-launch-chrome" /installsource otherinstallcmd /sessionid "{7637CFCB-E08D-43D4-B1F7-C24DAB13BB80}" /silentJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /registermsihelper
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /uninstall
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\AVGBrowserInstaller.exe "C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\AVGBrowserInstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=chrome --import-cookies --auto-launch-chrome --system-level
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\AVGBrowserInstaller.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe "C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe" --install-archive="C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\SECURE.PACKED.7Z" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=chrome --import-cookies --auto-launch-chrome --system-level
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe "C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=124.0.25069.209 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff60185a3f0,0x7ff60185a3fc,0x7ff60185a408
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --heartbeat --hourly
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --heartbeat --logon
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\Temp\\Heartbeat8108_647370180 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\Temp\\Heartbeat8108_647370180\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=124.0.25069.209 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8a7b0dc40,0x7ff8a7b0dc4c,0x7ff8a7b0dc58
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2124,i,2166630059599507292,14770330184015614422,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:2
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\Temp\\Heartbeat8128_116327840 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\Temp\\Heartbeat8128_116327840\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=124.0.25069.209 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8a7b0dc40,0x7ff8a7b0dc4c,0x7ff8a7b0dc58
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2028,i,14563547802735666349,826896251076988020,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Windows\System32\svchost.exeProcess created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe AVGBrowser.exe --heartbeat --install --create-profile
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Users\user\Desktop\file.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: usp10.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: d2d1.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: windowscodecs.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: dataexchange.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: d3d11.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: dcomp.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: dxgi.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: resourcepolicyclient.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: d3d10warp.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: dxcore.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: qmgr.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: bitsperf.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: esent.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: bitsigd.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: upnp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ssdpapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: wsmauto.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: miutils.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: wsmsvc.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: dsrole.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: pcwum.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: mi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: webio.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: usermgrcli.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: execmodelclient.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: resourcepolicyclient.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vssapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vsstrace.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: samlib.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: es.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: bitsproxy.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: ieframe.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: mlang.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: schannel.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: wldp.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: msi.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: version.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: userenv.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: msimg32.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: wininet.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: msxml3.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: propsys.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: edputil.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: slc.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: sppc.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wldp.dllJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: msi.dllJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: version.dllJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: userenv.dllJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: msimg32.dllJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wininet.dllJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: iphlpapi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: msi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: netapi32.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: version.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wtsapi32.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: msimg32.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: uxtheme.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wininet.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wkscli.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: netutils.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: cscapi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: ntmarta.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dbgcore.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dbgcore.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: iertutil.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: iphlpapi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: msi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: netapi32.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: version.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wtsapi32.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: msimg32.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: uxtheme.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wininet.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wkscli.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: netutils.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: cscapi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: ntmarta.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dbgcore.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dbgcore.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: iertutil.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: iphlpapi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: msi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: netapi32.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: version.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wtsapi32.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: msimg32.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: uxtheme.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wininet.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wkscli.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: netutils.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: cscapi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: ntmarta.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dbgcore.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dbgcore.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: edputil.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: urlmon.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: iertutil.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: srvcli.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wintypes.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: appresolver.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: bcp47langs.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: slc.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: sppc.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: winsta.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: winhttp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: webio.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: mswsock.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: winnsi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: sspicli.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dnsapi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: rasadhlp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: schannel.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: mskeyprotect.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: ntasn1.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: ncrypt.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: ncryptsslp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: msxml3.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dpapi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: iphlpapi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: msi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: netapi32.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: version.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wtsapi32.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: msimg32.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: uxtheme.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wininet.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wkscli.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: netutils.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: cscapi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: ntmarta.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dbgcore.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dbgcore.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: srpapi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: tsappcmp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: msi.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: version.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: rstrtmgr.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: ncrypt.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: ntasn1.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: mpr.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: iphlpapi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: msi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: netapi32.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: version.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wtsapi32.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: msimg32.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: uxtheme.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wininet.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wkscli.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: netutils.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: cscapi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: ntmarta.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dbgcore.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dbgcore.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: winhttp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: webio.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: mswsock.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: winnsi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: sspicli.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dnsapi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: rasadhlp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: schannel.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: mskeyprotect.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: ntasn1.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: ncrypt.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: ncryptsslp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: msxml3.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dpapi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: iertutil.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: iphlpapi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: msi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: netapi32.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: version.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wtsapi32.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: msimg32.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: uxtheme.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wininet.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wkscli.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: netutils.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: cscapi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: ntmarta.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dbgcore.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: dbgcore.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: atlthunk.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: iertutil.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: iphlpapi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: msi.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: netapi32.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: version.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSection loaded: wtsapi32.dll
Source: C:\Users\user\Desktop\file.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\15.0\Lync\Capabilities\URLAssociations
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeDirectory created: C:\Program Files\AVG\Browser\AVGBrowserUninstall.exeJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\secure.7z
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Extensions
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\MEIPreload
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\VisualElements
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\124.0.25069.209.manifest
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\aswEngineConnector.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\AVGBrowser.exe.sig
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\browser_crash_reporter.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\chrome.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\chrome.dll.sig
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\chrome_100_percent.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\chrome_200_percent.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\chrome_elf.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\chrome_pwa_launcher.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\chrome_wer.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\config.def
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\d3dcompiler_47.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\dxcompiler.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\dxil.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\elevation_service.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\eventlog_provider.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Extensions\external_extensions.json
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\ffmpeg.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\icudtl.dat
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\libEGL.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\libGLESv2.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\af.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\am.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\ar.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\bg.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\bn.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\ca.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\cs.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\da.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\de.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\el.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\en-GB.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\en-US.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\es-419.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\es.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\et.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\fa.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\fi.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\fil.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\fr.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\gu.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\he.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\hi.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\hr.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\hu.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\id.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\it.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\ja.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\kn.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\ko.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\lt.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\lv.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\ml.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\mr.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\ms.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\nb.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\nl.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\pl.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\pt-BR.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\pt-PT.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\ro.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\ru.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\sk.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\sl.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\sr.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\sv.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\sw.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\ta.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\te.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\th.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\tr.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\uk.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\ur.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\vi.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\zh-CN.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\Locales\zh-TW.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\MEIPreload\manifest.json
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\MEIPreload\preloaded_data.pb
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\mimic.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\mojo_core.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\notification_helper.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\resources.pak
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\setup_helper_syslib.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\snapshot_blob.bin
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\v8_context_snapshot.bin
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\VisualElements\Logo.png
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\VisualElements\SmallLogo.png
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\vk_swiftshader.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\vk_swiftshader_icd.json
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\vulkan-1.dll
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\AVGBrowser.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\AVGBrowserProtect.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\AVGBrowserQHelper.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\AVGBrowserUninstall.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\browser_proxy.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\initial_preferences
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\AVGBrowser.VisualElementsManifest.xml
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Application
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Application\SetupMetrics
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Application\124.0.25069.209\Installer
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Application\124.0.25069.209\Installer\setup.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Application\124.0.25069.209\Installer\chrmstp.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Application\browser_proxy.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Application\initial_preferences
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Application\AVGBrowserQHelper.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDirectory created: C:\Program Files\AVG\Browser\Application\SetupMetrics\9235c4e7-ae53-479e-b681-9b7e025f31b5.tmp
Source: file.exeStatic PE information: certificate valid
Source: file.exeStatic file information: File size 6116304 > 1048576
Source: file.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: goopdateres_unsigned_ms.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000003222000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000440F000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2165133974.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2165205878.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2164927132.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_fa.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003961000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004337000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2152791561.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2152687306.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2152408496.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_ru.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000445F000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003A89000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2168125977.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2168061555.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2167925652.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_lt.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000043E1000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003A0B000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2163524223.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2163205272.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2163413117.00000000007A5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_el.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000003104000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042F1000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2150108705.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2150018075.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2149856176.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\9736f8b792bcd5e7\src\out\Release-x64\initialexe\AVGBrowser.exe.pdb source: AVGBrowser.exe, 0000001A.00000000.2869521627.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001B.00000000.2872124493.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001C.00000000.2875770965.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001D.00000000.2876092036.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001E.00000000.2878831708.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001F.00000002.2896650039.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp
Source: Binary string: goopdateres_unsigned_tr.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044C7000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2170590288.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_de.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042E6000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2149702229.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2149481017.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2149639323.00000000007A5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_bg.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030C0000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042AD000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2147250436.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2147135412.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2146941772.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_mr.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000003216000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004402000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2164735319.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2164643030.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2164450051.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: AVGBrowserUpdateComRegisterShell64_unsigned.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2145841812.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2146084049.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2146150231.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateComRegisterShell64.exe, 00000009.00000000.2186495616.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmp, AVGBrowserUpdateComRegisterShell64.exe, 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmp, AVGBrowserUpdateComRegisterShell64.exe, 0000000A.00000000.2190630223.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmp, AVGBrowserUpdateComRegisterShell64.exe, 0000000A.00000002.2192620515.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmp, AVGBrowserUpdateComRegisterShell64.exe, 0000000C.00000002.2195344439.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmp, AVGBrowserUpdateComRegisterShell64.exe, 0000000C.00000000.2193531111.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmp
Source: Binary string: AVGBrowserCrashHandler64_unsigned.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2145507317.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\9736f8b792bcd5e7\src\out\Release-x64\setup_nosign.exe.pdb source: setup.exe, 00000017.00000002.2873586684.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, setup.exe, 00000017.00000000.2539988971.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, setup.exe, 00000018.00000002.2876710388.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, setup.exe, 00000018.00000000.2544840578.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp
Source: Binary string: goopdateres_unsigned_gu.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000003177000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004364000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2154278126.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2154217263.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2154003772.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_sr.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002A94000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004481000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2169214564.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2169165916.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2169045548.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_th.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044BB000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2170430862.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psmachine_unsigned.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2172532345.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psmachine_unsigned_64.pdbT source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2172800095.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: AVGBrowserCrashHandler_unsigned.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000326F000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003BCE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psuser_unsigned.pdbX source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2171945813.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\9736f8b792bcd5e7\src\out\Release-avg-x64\mini_installer.exe.pdb source: AVGBrowserInstaller.exe, 00000014.00000000.2482861483.00007FF73BED4000.00000002.00000001.01000000.00000026.sdmp, AVGBrowserInstaller.exe, 00000014.00000002.2879711339.00007FF73BED4000.00000002.00000001.01000000.00000026.sdmp
Source: Binary string: AVGBrowserUpdateOnDemand_unsigned.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\9736f8b792bcd5e7\src\out\Release-x64\chrome_elf.dll.pdb source: AVGBrowser.exe, 0000001E.00000002.2898134802.00007FF8A7ACB000.00000002.00000001.01000000.00000029.sdmp
Source: Binary string: psuser_unsigned_64.pdbT source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2172227367.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_am.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2146198832.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2146406367.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2146331005.00000000007A5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: AVGBrowserUpdateWebPlugin_unsigned.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_ta.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044A3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003ACD000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2170084642.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_lv.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000043EC000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2163686580.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2163921549.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2163990015.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_cs.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030E2000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042CF000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2148756524.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2149020532.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2148956582.00000000007A5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdate_unsigned.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002B23000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000326F000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003BCE000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2143860339.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_hi.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000399A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004370000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2154799321.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2154508962.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2154944559.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: AVGBrowserUpdateBroker_unsigned.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2176127906.0000000000782000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_es-419.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003949000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000431F000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2151812044.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2151812044.00000000007A4000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2151560568.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mi_exe_stub.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000000.2108944984.0000000000B28000.00000002.00000001.01000000.00000018.sdmp
Source: Binary string: goopdateres_unsigned_pt-BR.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000443D000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003A67000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2167065963.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2166860815.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2167145584.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_hr.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000437C000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.000000000318F000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2155429261.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2155653574.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2155088171.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_id.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004392000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000031A6000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2159583853.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2159098504.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2158363262.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psuser_unsigned_64.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2172227367.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: AVGBrowserUpdateComRegisterShell64_unsigned.pdb^ source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2145841812.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2146084049.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2146150231.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateComRegisterShell64.exe, 00000009.00000000.2186495616.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmp, AVGBrowserUpdateComRegisterShell64.exe, 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmp, AVGBrowserUpdateComRegisterShell64.exe, 0000000A.00000000.2190630223.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmp, AVGBrowserUpdateComRegisterShell64.exe, 0000000A.00000002.2192620515.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmp, AVGBrowserUpdateComRegisterShell64.exe, 0000000C.00000002.2195344439.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmp, AVGBrowserUpdateComRegisterShell64.exe, 0000000C.00000000.2193531111.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmp
Source: Binary string: goopdateres_unsigned_zh-TW.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044FF000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000002.2908350799.0000000000ABF000.00000004.00000010.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2171629574.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psmachine_unsigned.pdbX source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2172532345.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_sw.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002AAB000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004498000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2169921274.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2169760351.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2169979059.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_it.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000043A9000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.00000000039D3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2160342541.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2160573365.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2160666549.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_pt-PT.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003A72000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004448000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2167235240.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2167405477.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2167460912.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_vi.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044E8000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003B13000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2171109384.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_bn.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.00000000038E2000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042B8000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2147746330.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2147854898.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2147498223.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: acuapi_64_unsigned.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2173471506.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_sv.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000448D000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002AA0000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2169451957.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2169609203.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2169288884.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_ja.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000031D3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2161534514.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2161282116.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2161673996.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_es.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000393E000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004314000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2151022828.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2151295194.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2151365862.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_is.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.00000000039C8000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000439E000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2159809709.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2160034051.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2160191266.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_ro.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003A7E000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004453000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2167789427.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2167735488.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2167562873.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_uk.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002AE5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044D2000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2170749651.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_fr.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003983000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004358000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2153691467.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2153837503.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2153911762.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_ca.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030D6000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042C3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2148671542.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2148513714.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2148000470.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_nl.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000441A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.000000000322D000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2165310044.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2165673173.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2165540989.00000000007A5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_ko.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000031E9000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000043D6000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2162834499.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2162957240.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2162442370.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_et.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.000000000313E000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000432B000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2152035302.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2152168818.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2152246594.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_ur.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003B07000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044DD000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2170927202.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_no.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000003239000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004426000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2166353148.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2165885183.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2166432853.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_iw.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000031C8000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000043B5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2161092400.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2160811345.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2160987300.00000000007A5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_te.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003AD9000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044AF000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2170266211.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_fil.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003977000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000434D000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2153610715.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2153306642.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2153556127.00000000007A5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_pl.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004431000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003A5B000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2166681516.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2166534186.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2166754218.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_en-GB.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003933000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004309000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000002.2900499809.0000000000A10000.00000002.00000001.00040000.0000002D.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2150672751.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2150920384.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2150858095.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000011.00000002.2888623349.0000000000C00000.00000002.00000001.00040000.0000002C.sdmp, AVGBrowserUpdate.exe, 00000012.00000002.2896108642.00000000013E0000.00000002.00000001.00040000.0000002C.sdmp
Source: Binary string: goopdateres_unsigned_fi.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000396C000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004342000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2152886939.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2153171386.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2153084030.00000000007A5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_sk.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000446A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002A7E000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2168546407.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2168236782.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2168465236.00000000007A5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psuser_unsigned.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2171945813.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_ml.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.000000000320A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000043F7000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2164264655.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2164335990.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2164095384.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: npAvgBrowserUpdate3_unsigned.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002B23000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000326F000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003BCE000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2176075476.0000000000781000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2176029036.0000000000791000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_hu.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004387000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.000000000319A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2156600983.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2157791884.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2158175358.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_da.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003905000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042DB000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2149386687.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2149172877.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2149326912.00000000007A5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_en.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042FD000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000003110000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2150223781.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2150536478.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2150458860.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000006.00000002.2180276782.0000000000C20000.00000002.00000001.00040000.0000001E.sdmp, AVGBrowserUpdate.exe, 0000000D.00000002.2292632206.0000000000F60000.00000002.00000001.00040000.0000001E.sdmp, AVGBrowserUpdate.exe, 00000012.00000002.2896542114.00000000014B0000.00000002.00000001.00040000.0000001E.sdmp
Source: Binary string: psmachine_unsigned_64.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2172800095.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_ar.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.00000000038CC000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042A2000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2146568139.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2146833064.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2146745656.00000000007A5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_sl.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002A89000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004476000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2168861429.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2168701046.0000000000796000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2168945218.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: AVGBrowserUpdate_unsigned.pdb source: AVGBrowserUpdate.exe, AVGBrowserUpdate.exe, 00000006.00000002.2179645124.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, AVGBrowserUpdate.exe, 00000008.00000000.2185347276.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, AVGBrowserUpdate.exe, 0000000B.00000000.2192928136.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, AVGBrowserUpdate.exe, 0000000D.00000000.2193569917.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, AVGBrowserUpdate.exe, 0000000E.00000002.2217270400.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, AVGBrowserUpdate.exe, 00000010.00000002.2244031208.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, AVGBrowserUpdate.exe, 00000011.00000002.2887745804.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, AVGBrowserUpdate.exe, 00000012.00000000.2227648919.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, AVGBrowserUpdate.exe, 00000013.00000002.2284298938.0000000000071000.00000020.00000001.01000000.0000001C.sdmp
Source: Binary string: goopdateres_unsigned_zh-CN.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044F4000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002B07000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2171368998.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_kn.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000031DE000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000043CB000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2162128901.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2162261282.0000000000795000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2161914207.0000000000796000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: acuapi_unsigned.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2173194656.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: AVGBrowserUpdateCore_unsigned.pdb source: AVGBrowserUpdateSetup.exe, 00000004.00000002.2908350799.0000000000AC4000.00000004.00000010.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000005.00000003.2145023147.0000000000795000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B17F90 LoadLibraryW,GetProcAddress,FreeLibrary,9_2_00007FF677B17F90
Source: ajF04F.exe.0.drStatic PE information: real checksum: 0x5d664c should be: 0x5dd049
Source: file.exeStatic PE information: real checksum: 0x5d664c should be: 0x5daa1d
Source: AVGBrowserUninstall.exe.3.drStatic PE information: real checksum: 0x5d664c should be: 0x5dd049
Source: AVGBrowserUpdateComRegisterShell64.exe.4.drStatic PE information: section name: _RDATA
Source: acuapi_64.dll.4.drStatic PE information: section name: _RDATA
Source: psmachine.dll.4.drStatic PE information: section name: .orpc
Source: psmachine_64.dll.4.drStatic PE information: section name: .orpc
Source: psmachine_64.dll.4.drStatic PE information: section name: _RDATA
Source: psuser.dll.4.drStatic PE information: section name: .orpc
Source: psuser_64.dll.4.drStatic PE information: section name: .orpc
Source: psuser_64.dll.4.drStatic PE information: section name: _RDATA
Source: AVGBrowserCrashHandler64.exe.4.drStatic PE information: section name: _RDATA
Source: AVGBrowserCrashHandler64.exe.5.drStatic PE information: section name: _RDATA
Source: AVGBrowserUpdateComRegisterShell64.exe.5.drStatic PE information: section name: _RDATA
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeCode function: 4_2_00B264C6 push ecx; ret 4_2_00B264D9
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeCode function: 5_2_00A742F6 push ecx; ret 5_2_00A74309
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeCode function: 6_2_000842F6 push ecx; ret 6_2_00084309
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeCode function: 18_2_02A5D325 pushad ; ret 18_2_02A5D40E
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeCode function: 18_2_02A5EB00 pushad ; ret 18_2_02A5EB01
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeCode function: 18_2_02A5D149 pushad ; ret 18_2_02A5D14A
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exeCode function: 32_2_0077CB46 push ecx; ret 32_2_0077CB59
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile created: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\jsisdl.dllJump to dropped file
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\Download\{48F69C39-1356-4A7B-A899-70E3539D4982}\124.0.25069.209\AVGBrowserInstaller.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_id.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_pt-PT.dllJump to dropped file
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\AVGBrowserInstaller.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_pl.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\npAvgBrowserUpdate3.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_sw.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdate.exeJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_am.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_es.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_bn.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\acuapi.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\nsgE448.tmp\inetc.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_bg.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_mr.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_hu.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ta.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_sl.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\nsgE448.tmp\sciterui.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\psmachine.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\psuser_64.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdateComRegisterShell64.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_fa.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_uk.dllJump to dropped file
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\AVGBrowserInstaller.exeJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\nsgE448.tmp\JsisPlugins.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_et.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\acuapi_64.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_iw.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_te.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_el.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile created: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_lv.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ja.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ar.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exeJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateSetup.exeJump to dropped file
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeFile created: C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_da.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\npAvgBrowserUpdate3.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\psmachine_64.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\nsgE448.tmp\jsisdl.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_sr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdateWebPlugin.exeJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateCore.exeJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_zh-TW.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdateSetup.exeJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_lt.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserCrashHandler64.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_is.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_de.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_cs.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile created: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\inetc.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_am.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_en.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateBroker.exeJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_id.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateOnDemand.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\acuapi.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ms.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_pt-PT.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ca.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_sv.dllJump to dropped file
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeFile created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\browser_crash_reporter.exeJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\nsgE448.tmp\StdUtils.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_fr.dllJump to dropped file
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeFile created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\aswEngineConnector.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_fil.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_en-GB.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ko.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_hr.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\nsgE448.tmp\nsJSON.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ur.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_no.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserCrashHandler.exeJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_pl.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\{DF5A446B-D24D-4C0E-B25C-417D247911DA}\scrt.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdate.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ml.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdateBroker.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_tr.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_fi.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ru.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_uk.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_gu.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\nsgE448.tmp\AccessControl.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_hi.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_th.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ca.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_nl.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_et.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ro.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_it.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_iw.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_fi.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_vi.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile created: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\StdUtils.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ja.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\psmachine.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_no.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_te.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\nsgE448.tmp\reboot.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_cs.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_da.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_zh-TW.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile created: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\Midex.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_sr.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_en-GB.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\psmachine_64.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_es-419.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\nsgE448.tmp\thirdparty.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_es-419.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_fr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile created: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\sciterui.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_sk.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ms.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateWebPlugin.exeJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\nsgE448.tmp\jsis.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\psuser_64.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\nsgE448.tmp\Midex.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_hu.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\acuapi_64.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\ajF04F.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_kn.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile created: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\nsJSON.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_sl.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_zh-CN.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\psuser.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_es.dllJump to dropped file
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeFile created: C:\Users\user\AppData\Local\Temp\{1FF43E4D-AA88-4479-9A55-5241D9C8AAC8}-AVGBrowserInstaller.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile created: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\thirdparty.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile created: C:\Program Files\AVG\Browser\AVGBrowserUninstall.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ko.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile created: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\jsis.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ur.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_sk.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdateOnDemand.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_pt-BR.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_bg.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_mr.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_el.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ml.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_lv.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ru.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_hr.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_tr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_gu.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_nl.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ar.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ro.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_th.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_hi.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeJump to dropped file
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeFile created: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\chrome.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdate.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_vi.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_kn.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_lt.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile created: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\reboot.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_sw.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_de.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_en.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_pt-BR.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_sv.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile created: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AccessControl.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ta.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_is.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_fil.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_bn.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\psuser.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_it.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdateCore.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeFile created: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_zh-CN.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile created: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\JsisPlugins.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeFile created: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_fa.dllJump to dropped file
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B22374 SHGetFolderPathW,_invalid_parameter_noinfo_noreturn,GetPrivateProfileStringW,_Init_thread_footer,9_2_00007FF677B22374
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B15414 GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileStringW,GetPrivateProfileIntW,9_2_00007FF677B15414
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeFile created: C:\Users\user\AppData\Local\Temp\AVGBrowser_installer.log

Boot Survival

barindex
Creates an undocumented autostart registry key
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGBrowserUpdate.exe DisableExceptionChainValidationJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGBrowserUpdate.exe DisableExceptionChainValidationJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982} NULL
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982} NULL
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982} StubPath
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982} StubPath
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982} Localized Name
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982} Localized Name
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982} IsInstalled
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982} IsInstalled
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982} Version
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982} Version
Creates multiple autostart registry keys
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AVGBrowserAutoLaunch_726B817271C484847A690E2C1C98BF60
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AVGBrowserAutoLaunch_53F4AD9791D53E4F31988DF26A2B411E
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AVGBrowserAutoLaunch_6124C6D99F5330FF26FB94C49688230C
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGBrowserUpdate.exe DisableExceptionChainValidationJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeRegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\Browser
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AVGBrowserAutoLaunch_53F4AD9791D53E4F31988DF26A2B411E
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AVGBrowserAutoLaunch_53F4AD9791D53E4F31988DF26A2B411E
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AVGBrowserAutoLaunch_726B817271C484847A690E2C1C98BF60
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AVGBrowserAutoLaunch_726B817271C484847A690E2C1C98BF60
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AVGBrowserAutoLaunch_6124C6D99F5330FF26FB94C49688230C
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AVGBrowserAutoLaunch_6124C6D99F5330FF26FB94C49688230C
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdateJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeRegistry key monitored for changes: HKEY_USERS.DEFAULT\Software\Classes
Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\file.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\file.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\file.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\file.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\file.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\file.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\file.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\file.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\file.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\file.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

barindex
Checks if the current machine is a virtual machine (disk enumeration)
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Found evasive API chain (may stop execution after checking volume information)
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\AVGBrowserInstaller.exeEvasive API call chain: GetVolumeInformation,DecisionNodes,ExitProcess
Found evasive API chain checking for user administrative privileges
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeCheck user administrative privileges: IsUserAndAdmin, DecisionNodegraph_4-12080
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSystem information queried: FirmwareTableInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeSystem information queried: FirmwareTableInformationJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeSystem information queried: FirmwareTableInformationJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeSystem information queried: FirmwareTableInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeSystem information queried: FirmwareTableInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeSystem information queried: FirmwareTableInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeSystem information queried: FirmwareTableInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeFile opened / queried: C:\Program Files\VMware\VMware Tools
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeFile opened / queried: C:\Program Files (x86)\VMware\VMware Tools
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690EF9820 rdtsc 30_2_00007FF690EF9820
Source: C:\Users\user\Desktop\file.exeWindow / User API: windowPlacementGot 790Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\jsisdl.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_pt-PT.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_id.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_pl.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\npAvgBrowserUpdate3.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_sw.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_am.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\acuapi.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_bn.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_mr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_bg.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgE448.tmp\inetc.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ta.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_hu.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_sl.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgE448.tmp\sciterui.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\psuser_64.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\psmachine.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_fa.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_uk.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgE448.tmp\JsisPlugins.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_et.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_iw.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\acuapi_64.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_te.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_el.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_lv.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ja.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ar.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_da.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\npAvgBrowserUpdate3.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\psmachine_64.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgE448.tmp\jsisdl.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_sr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdateWebPlugin.exeJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateCore.exeJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_zh-TW.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_lt.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_de.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_is.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_cs.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\inetc.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_am.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_en.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateBroker.exeJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_id.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateOnDemand.exeJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_pt-PT.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ms.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\acuapi.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ca.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_sv.dllJump to dropped file
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDropped PE file which has not been started: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\browser_crash_reporter.exeJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgE448.tmp\StdUtils.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_fr.dllJump to dropped file
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDropped PE file which has not been started: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\aswEngineConnector.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_fil.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ko.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_en-GB.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_hr.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ur.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgE448.tmp\nsJSON.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_no.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_pl.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{DF5A446B-D24D-4C0E-B25C-417D247911DA}\scrt.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdate.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ml.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdateBroker.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_tr.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_fi.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ru.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_uk.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_gu.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgE448.tmp\AccessControl.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_th.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_hi.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ca.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_nl.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_et.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ro.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_it.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_iw.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_fi.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_vi.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\StdUtils.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ja.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\psmachine.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_te.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_no.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgE448.tmp\reboot.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_cs.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_da.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_zh-TW.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\Midex.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\psmachine_64.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_en-GB.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_sr.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_es-419.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgE448.tmp\thirdparty.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_es-419.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_fr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\sciterui.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_sk.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateWebPlugin.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ms.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgE448.tmp\jsis.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\psuser_64.dllJump to dropped file
Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgE448.tmp\Midex.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\acuapi_64.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_hu.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_kn.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\nsJSON.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_sl.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_zh-CN.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\psuser.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\thirdparty.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ko.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\jsis.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ur.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_sk.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdateOnDemand.exeJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_bg.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_pt-BR.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_mr.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_el.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ml.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ru.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_lv.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_hr.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_tr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_gu.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_nl.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ar.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_th.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_hi.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ro.dllJump to dropped file
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeDropped PE file which has not been started: C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\chrome.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdate.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_vi.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_kn.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_lt.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\reboot.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_sw.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_de.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_en.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_pt-BR.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_sv.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AccessControl.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ta.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_is.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_fil.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_bn.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\psuser.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_it.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdateCore.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GUMA6B.tmp\goopdateres_zh-CN.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\JsisPlugins.dllJump to dropped file
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_fa.dllJump to dropped file
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\AVGBrowserInstaller.exeEvasive API call chain: RegOpenKey,DecisionNodes,ExitProcess
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\AVGBrowserInstaller.exeEvasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\AVGBrowserInstaller.exeCheck user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeAPI coverage: 9.3 %
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeAPI coverage: 9.8 %
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeAPI coverage: 7.8 %
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeAPI coverage: 6.7 %
Source: C:\Windows\System32\svchost.exe TID: 5844Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe TID: 7312Thread sleep time: -30000s >= -30000s
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe TID: 7384Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0Jump to behavior
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_Bios
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_Bios
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_Bios
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeFile Volume queried: C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Code Cache\wasm FullSizeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeFile Volume queried: C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Code Cache\js FullSizeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeFile Volume queried: C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\blob_storage\5e8100cf-7159-4e99-9313-0a869d31e733 FullSizeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeFile Volume queried: C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default FullSizeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeFile Volume queried: C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180 FullSizeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeFile Volume queried: C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Code Cache\wasm FullSizeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeFile Volume queried: C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Code Cache\js FullSizeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeFile Volume queried: C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Code Cache\wasm FullSizeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeFile Volume queried: C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Code Cache\js FullSizeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeFile Volume queried: C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\blob_storage\197db9ea-a404-48c2-aea2-45dc34949ea9 FullSizeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeFile Volume queried: C:\Users\user\AppData\Local\AVG\Browser\User Data\Default FullSizeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeFile Volume queried: C:\Users\user\AppData\Local\AVG\Browser\User Data FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeCode function: 4_2_00B1C375 FindFirstFileExW,4_2_00B1C375
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeCode function: 5_2_00A6D8AF FindFirstFileExW,5_2_00A6D8AF
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeCode function: 6_2_0007D8AF FindFirstFileExW,6_2_0007D8AF
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B4F014 FindFirstFileExW,9_2_00007FF677B4F014
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exeCode function: 32_2_00776015 FindFirstFileExW,32_2_00776015
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exeCode function: 33_2_00007FF60BFD6F4C _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,33_2_00007FF60BFD6F4C
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile opened: C:\Users\userJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile opened: C:\Users\user\AppData\Local\Google\ChromeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile opened: C:\Users\user\AppDataJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User DataJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile opened: C:\Users\user\AppData\Local\GoogleJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile opened: C:\Users\user\AppData\LocalJump to behavior
Source: AVGBrowserUpdate.exe, 00000010.00000002.2245081307.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000010.00000003.2242142015.0000000000CC7000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000010.00000003.2243565183.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000010.00000003.2243791317.0000000000CCD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWU
Source: AVGBrowser.exe, 0000001C.00000003.3008186896.000002822CFFB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: ajF04F.exe, 00000003.00000003.2099462467.000000000395A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 0000000D.00000002.2284690621.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 0000000D.00000002.2292259990.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 0000000D.00000003.2280447200.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000010.00000002.2244814021.0000000000C9D000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000010.00000002.2245081307.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000010.00000003.2242142015.0000000000CC7000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000010.00000003.2242142015.0000000000C99000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000010.00000003.2243565183.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000010.00000003.2243791317.0000000000CCD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: AVGBrowserUpdate.exe, 00000005.00000002.2900214476.00000000007AD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}^j
Source: AVGBrowser.exe, 0000001C.00000003.3008484978.000002822D00D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: AGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: AVGBrowser.exe, 0000001C.00000003.3054877241.000002822D005000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}d|
Source: C:\Users\user\Desktop\file.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeProcess queried: DebugPortJump to behavior
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess queried: DebugPort
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess queried: DebugPort
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess queried: DebugPort
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess queried: DebugPort
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess queried: DebugPort
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess queried: DebugPort
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690EF9820 rdtsc 30_2_00007FF690EF9820
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeCode function: 4_2_00B1BCC4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_00B1BCC4
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B30DEC InitializeCriticalSectionAndSpinCount,GetLastError,IsDebuggerPresent,OutputDebugStringW,9_2_00007FF677B30DEC
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B17F90 LoadLibraryW,GetProcAddress,FreeLibrary,9_2_00007FF677B17F90
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeCode function: 4_2_00B1D630 mov eax, dword ptr fs:[00000030h]4_2_00B1D630
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeCode function: 4_2_00B187D6 mov ecx, dword ptr fs:[00000030h]4_2_00B187D6
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeCode function: 5_2_00A6BEA8 mov ecx, dword ptr fs:[00000030h]5_2_00A6BEA8
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeCode function: 5_2_00A6D651 mov eax, dword ptr fs:[00000030h]5_2_00A6D651
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeCode function: 6_2_0007D651 mov eax, dword ptr fs:[00000030h]6_2_0007D651
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeCode function: 6_2_0007BEA8 mov ecx, dword ptr fs:[00000030h]6_2_0007BEA8
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exeCode function: 32_2_0077485A mov ecx, dword ptr fs:[00000030h]32_2_0077485A
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exeCode function: 32_2_00776E79 mov eax, dword ptr fs:[00000030h]32_2_00776E79
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeCode function: 4_2_00B111D5 GetProcessHeap,__Init_thread_footer,__Init_thread_footer,4_2_00B111D5
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess token adjusted: DebugJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess token adjusted: DebugJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess token adjusted: DebugJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess token adjusted: Debug
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeCode function: 4_2_00B1BCC4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_00B1BCC4
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeCode function: 4_2_00B1557C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_00B1557C
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeCode function: 4_2_00B15A10 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,4_2_00B15A10
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeCode function: 4_2_00B15710 SetUnhandledExceptionFilter,4_2_00B15710
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeCode function: 5_2_00A67D01 SetUnhandledExceptionFilter,5_2_00A67D01
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeCode function: 5_2_00A67A48 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,5_2_00A67A48
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeCode function: 5_2_00A6B7EE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,5_2_00A6B7EE
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeCode function: 5_2_00A67B6A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,5_2_00A67B6A
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeCode function: 6_2_00077D01 SetUnhandledExceptionFilter,6_2_00077D01
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeCode function: 6_2_00077A48 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,6_2_00077A48
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeCode function: 6_2_00077B6A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,6_2_00077B6A
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeCode function: 6_2_0007B7EE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,6_2_0007B7EE
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B38FE8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,9_2_00007FF677B38FE8
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B31708 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,9_2_00007FF677B31708
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B31CA0 SetUnhandledExceptionFilter,9_2_00007FF677B31CA0
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B31ABC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,9_2_00007FF677B31ABC
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 23_2_00007FF6016C79A8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,23_2_00007FF6016C79A8
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 23_2_00007FF6016AEC08 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,23_2_00007FF6016AEC08
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 24_2_00007FF6016C79A8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,24_2_00007FF6016C79A8
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeCode function: 24_2_00007FF6016AEC08 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,24_2_00007FF6016AEC08
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF69104BE54 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,30_2_00007FF69104BE54
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF691032DA8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,30_2_00007FF691032DA8
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exeCode function: 32_2_0077187E SetUnhandledExceptionFilter,32_2_0077187E
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exeCode function: 32_2_007759A4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,32_2_007759A4
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exeCode function: 32_2_0077125E SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,32_2_0077125E
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exeCode function: 32_2_007716EA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,32_2_007716EA
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exeCode function: 33_2_00007FF60BFD693C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,33_2_00007FF60BFD693C
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exeCode function: 33_2_00007FF60BFD1980 SetUnhandledExceptionFilter,33_2_00007FF60BFD1980
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exeCode function: 33_2_00007FF60BFD12AC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,33_2_00007FF60BFD12AC
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exeCode function: 33_2_00007FF60BFD179C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,33_2_00007FF60BFD179C

HIPS / PFW / Operating System Protection Evasion

barindex
Contains functionality to prevent local Windows debugging
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B29FFC OutputDebugStringA,WaitForSingleObject,InitializeCriticalSection,EnterCriticalSection,SetFilePointer,WriteFile,ReleaseMutex,LeaveCriticalSection,IsDebuggerPresent,DebugBreak,GetCurrentProcess,TerminateProcess,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,9_2_00007FF677B29FFC
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTY5My42IiBzaGVsbF92ZXJzaW9uPSIxLjguMTY5My42IiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0iezc2MzdDRkNCLUUwOEQtNDNENC1CMUY3LUMyNERBQjEzQkI4MH0iIGNlcnRfZXhwX2RhdGU9IjIwMjUwOTE3IiB1c2VyaWQ9IntFMUJBQjY4OC1CMDJGLTQ3NDktOUY4OC0zRTFCNEU3REE5OTR9IiB1c2VyaWRfZGF0ZT0iMjAyNDA2MDMiIG1hY2hpbmVpZD0iezAwMDBGOEI1LUM3REUtQTQ4Qy1EMDU4LTA3RTI0NTVCOUE1Qn0iIG1hY2hpbmVpZF9kYXRlPSIyMDI0MDYwMyIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9InsyNTJFNzAzQS1GNkRGLTRBQjYtOTE2MS00NEZENUYwNjYwMER9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDUuMjAwNiIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuOC4xNjkzLjYiIGxhbmc9ImVuLUdCIiBicmFuZD0iOTI0OSIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iNjA2MyIvPjwvYXBwPjwvcmVxdWVzdD4Jump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /handoff "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-GB&brand=9249&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dchrome --import-cookies --auto-launch-chrome" /installsource otherinstallcmd /sessionid "{7637CFCB-E08D-43D4-B1F7-C24DAB13BB80}" /silentJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /registermsihelper
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe "C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=124.0.25069.209 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff60185a3f0,0x7ff60185a3fc,0x7ff60185a408
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\Temp\\Heartbeat8108_647370180 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\Temp\\Heartbeat8108_647370180\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=124.0.25069.209 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8a7b0dc40,0x7ff8a7b0dc4c,0x7ff8a7b0dc58
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2124,i,2166630059599507292,14770330184015614422,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:2
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\Temp\\Heartbeat8128_116327840 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\Temp\\Heartbeat8128_116327840\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=124.0.25069.209 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8a7b0dc40,0x7ff8a7b0dc4c,0x7ff8a7b0dc58
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2028,i,14563547802735666349,826896251076988020,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Windows\System32\svchost.exeProcess created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe AVGBrowser.exe --heartbeat --install --create-profile
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeProcess created: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe avgbrowserupdatesetup.exe /silent /install "bundlename=avg secure browser&appguid={48f69c39-1356-4a7b-a899-70e3539d4982}&appname=avg secure browser&needsadmin=true&lang=en-gb&brand=9249&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3dchrome --import-cookies --auto-launch-chrome"
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeProcess created: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe "c:\program files (x86)\guma6b.tmp\avgbrowserupdate.exe" /silent /install "bundlename=avg secure browser&appguid={48f69c39-1356-4a7b-a899-70e3539d4982}&appname=avg secure browser&needsadmin=true&lang=en-gb&brand=9249&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3dchrome --import-cookies --auto-launch-chrome"
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe "c:\program files (x86)\avg\browser\update\avgbrowserupdate.exe" /ping pd94bwwgdmvyc2lvbj0ims4wiiblbmnvzgluzz0ivvrgltgipz48cmvxdwvzdcbwcm90b2nvbd0imy4wiib1cgrhdgvypsjpbwfoysigb21hagfpzd0iezfdodlfrjjglue4oeutnerfmc05n0zfluncndbdoeu0rkvfqx0iihvwzgf0zxj2zxjzaw9upsixljgumty5my42iibzagvsbf92zxjzaw9upsixljgumty5my42iibpc21hy2hpbmu9ijeiiglzx29tywhhnjriaxq9ijaiiglzx29znjriaxq9ijeiihnlc3npb25pzd0iezc2mzddrkncluuwoeqtndnenc1cmuy3lumynerbqjezqki4mh0iignlcnrfzxhwx2rhdgu9ijiwmjuwote3iib1c2vyawq9intfmujbqjy4oc1cmdjgltq3ndktouy4oc0zrtfcneu3ree5otr9iib1c2vyawrfzgf0zt0imjaynda2mdmiig1hy2hpbmvpzd0iezawmdbgoei1lum3reutqtq4qy1emdu4lta3rti0ntvcoue1qn0iig1hy2hpbmvpzf9kyxrlpsiymdi0mdywmyigaw5zdgfsbhnvdxjjzt0ib3rozxjpbnn0ywxsy21kiib0zxn0c291cmnlpsjhdxrviibyzxf1zxn0awq9insyntjfnzazqs1gnkrgltrbqjytote2ms00nezenuywnjywmer9iibkzwr1cd0iy3iiigrvbwfpbmpvaw5lzd0imci-pgh3ihboexntzw1vcnk9ijgiihnzzt0imsigc3nlmj0imsigc3nlmz0imsigc3nzztm9ijeiihnzztqxpsixiibzc2u0mj0imsigyxz4psixii8-pg9zihbsyxrmb3jtpsj3aw4iihzlcnnpb249ijewljaumtkwnduumjawniigc3a9iiigyxjjad0iedy0ii8-pgfwccbhchbpzd0iezfdodlfrjjglue4oeutnerfmc05n0zfluncndbdoeu0rkvfqx0iihzlcnnpb249iiigbmv4dhzlcnnpb249ijeuoc4xnjkzljyiigxhbmc9imvuludciibicmfuzd0ioti0osigy2xpzw50psiipjxldmvudcbldmvudhr5cgu9ijiiigv2zw50cmvzdwx0psixiiblcnjvcmnvzgu9ijaiigv4dhjhy29kzte9ijaiigluc3rhbgxfdgltzv9tcz0inja2myivpjwvyxbwpjwvcmvxdwvzdd4
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe "c:\program files (x86)\avg\browser\update\avgbrowserupdate.exe" /handoff "bundlename=avg secure browser&appguid={48f69c39-1356-4a7b-a899-70e3539d4982}&appname=avg secure browser&needsadmin=true&lang=en-gb&brand=9249&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3dchrome --import-cookies --auto-launch-chrome" /installsource otherinstallcmd /sessionid "{7637cfcb-e08d-43d4-b1f7-c24dab13bb80}" /silent
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\AVGBrowserInstaller.exe "c:\program files (x86)\avg\browser\update\install\{4677e0b5-6b78-429f-9d3a-dc313e93f94b}\avgbrowserinstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=chrome --import-cookies --auto-launch-chrome --system-level
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\AVGBrowserInstaller.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe "c:\program files (x86)\avg\browser\update\install\{4677e0b5-6b78-429f-9d3a-dc313e93f94b}\cr_80683.tmp\setup.exe" --install-archive="c:\program files (x86)\avg\browser\update\install\{4677e0b5-6b78-429f-9d3a-dc313e93f94b}\cr_80683.tmp\secure.packed.7z" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=chrome --import-cookies --auto-launch-chrome --system-level
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe "c:\program files (x86)\avg\browser\update\install\{4677e0b5-6b78-429f-9d3a-dc313e93f94b}\cr_80683.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=c:\windows\systemtemp\crashpad --url=fake_url --annotation=plat=win64 --annotation=prod=avg --annotation=ver=124.0.25069.209 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff60185a3f0,0x7ff60185a3fc,0x7ff60185a408
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe "c:\program files\avg\browser\application\avgbrowser.exe" --type=crashpad-handler --user-data-dir=c:\users\user\appdata\local\temp\\heartbeat8108_647370180 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=c:\users\user\appdata\local\temp\\heartbeat8108_647370180\crashpad --url=fake_url --annotation=plat=win64 --annotation=prod=avg --annotation=ver=124.0.25069.209 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8a7b0dc40,0x7ff8a7b0dc4c,0x7ff8a7b0dc58
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe "c:\program files\avg\browser\application\avgbrowser.exe" --type=crashpad-handler --user-data-dir=c:\users\user\appdata\local\temp\\heartbeat8128_116327840 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=c:\users\user\appdata\local\temp\\heartbeat8128_116327840\crashpad --url=fake_url --annotation=plat=win64 --annotation=prod=avg --annotation=ver=124.0.25069.209 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8a7b0dc40,0x7ff8a7b0dc4c,0x7ff8a7b0dc58
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe "c:\program files\avg\browser\application\avgbrowser.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaeaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --field-trial-handle=2124,i,2166630059599507292,14770330184015614422,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:2
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe "c:\program files\avg\browser\application\avgbrowser.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaeaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --field-trial-handle=2028,i,14563547802735666349,826896251076988020,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeProcess created: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe avgbrowserupdatesetup.exe /silent /install "bundlename=avg secure browser&appguid={48f69c39-1356-4a7b-a899-70e3539d4982}&appname=avg secure browser&needsadmin=true&lang=en-gb&brand=9249&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3dchrome --import-cookies --auto-launch-chrome"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeProcess created: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe "c:\program files (x86)\guma6b.tmp\avgbrowserupdate.exe" /silent /install "bundlename=avg secure browser&appguid={48f69c39-1356-4a7b-a899-70e3539d4982}&appname=avg secure browser&needsadmin=true&lang=en-gb&brand=9249&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3dchrome --import-cookies --auto-launch-chrome"Jump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe "c:\program files (x86)\avg\browser\update\avgbrowserupdate.exe" /ping pd94bwwgdmvyc2lvbj0ims4wiiblbmnvzgluzz0ivvrgltgipz48cmvxdwvzdcbwcm90b2nvbd0imy4wiib1cgrhdgvypsjpbwfoysigb21hagfpzd0iezfdodlfrjjglue4oeutnerfmc05n0zfluncndbdoeu0rkvfqx0iihvwzgf0zxj2zxjzaw9upsixljgumty5my42iibzagvsbf92zxjzaw9upsixljgumty5my42iibpc21hy2hpbmu9ijeiiglzx29tywhhnjriaxq9ijaiiglzx29znjriaxq9ijeiihnlc3npb25pzd0iezc2mzddrkncluuwoeqtndnenc1cmuy3lumynerbqjezqki4mh0iignlcnrfzxhwx2rhdgu9ijiwmjuwote3iib1c2vyawq9intfmujbqjy4oc1cmdjgltq3ndktouy4oc0zrtfcneu3ree5otr9iib1c2vyawrfzgf0zt0imjaynda2mdmiig1hy2hpbmvpzd0iezawmdbgoei1lum3reutqtq4qy1emdu4lta3rti0ntvcoue1qn0iig1hy2hpbmvpzf9kyxrlpsiymdi0mdywmyigaw5zdgfsbhnvdxjjzt0ib3rozxjpbnn0ywxsy21kiib0zxn0c291cmnlpsjhdxrviibyzxf1zxn0awq9insyntjfnzazqs1gnkrgltrbqjytote2ms00nezenuywnjywmer9iibkzwr1cd0iy3iiigrvbwfpbmpvaw5lzd0imci-pgh3ihboexntzw1vcnk9ijgiihnzzt0imsigc3nlmj0imsigc3nlmz0imsigc3nzztm9ijeiihnzztqxpsixiibzc2u0mj0imsigyxz4psixii8-pg9zihbsyxrmb3jtpsj3aw4iihzlcnnpb249ijewljaumtkwnduumjawniigc3a9iiigyxjjad0iedy0ii8-pgfwccbhchbpzd0iezfdodlfrjjglue4oeutnerfmc05n0zfluncndbdoeu0rkvfqx0iihzlcnnpb249iiigbmv4dhzlcnnpb249ijeuoc4xnjkzljyiigxhbmc9imvuludciibicmfuzd0ioti0osigy2xpzw50psiipjxldmvudcbldmvudhr5cgu9ijiiigv2zw50cmvzdwx0psixiiblcnjvcmnvzgu9ijaiigv4dhjhy29kzte9ijaiigluc3rhbgxfdgltzv9tcz0inja2myivpjwvyxbwpjwvcmvxdwvzdd4Jump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe "c:\program files (x86)\avg\browser\update\avgbrowserupdate.exe" /handoff "bundlename=avg secure browser&appguid={48f69c39-1356-4a7b-a899-70e3539d4982}&appname=avg secure browser&needsadmin=true&lang=en-gb&brand=9249&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3dchrome --import-cookies --auto-launch-chrome" /installsource otherinstallcmd /sessionid "{7637cfcb-e08d-43d4-b1f7-c24dab13bb80}" /silentJump to behavior
Source: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\AVGBrowserInstaller.exe "c:\program files (x86)\avg\browser\update\install\{4677e0b5-6b78-429f-9d3a-dc313e93f94b}\avgbrowserinstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=chrome --import-cookies --auto-launch-chrome --system-level
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\AVGBrowserInstaller.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe "c:\program files (x86)\avg\browser\update\install\{4677e0b5-6b78-429f-9d3a-dc313e93f94b}\cr_80683.tmp\setup.exe" --install-archive="c:\program files (x86)\avg\browser\update\install\{4677e0b5-6b78-429f-9d3a-dc313e93f94b}\cr_80683.tmp\secure.packed.7z" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=chrome --import-cookies --auto-launch-chrome --system-level
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeProcess created: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe "c:\program files (x86)\avg\browser\update\install\{4677e0b5-6b78-429f-9d3a-dc313e93f94b}\cr_80683.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=c:\windows\systemtemp\crashpad --url=fake_url --annotation=plat=win64 --annotation=prod=avg --annotation=ver=124.0.25069.209 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff60185a3f0,0x7ff60185a3fc,0x7ff60185a408
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe "c:\program files\avg\browser\application\avgbrowser.exe" --type=crashpad-handler --user-data-dir=c:\users\user\appdata\local\temp\\heartbeat8108_647370180 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=c:\users\user\appdata\local\temp\\heartbeat8108_647370180\crashpad --url=fake_url --annotation=plat=win64 --annotation=prod=avg --annotation=ver=124.0.25069.209 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8a7b0dc40,0x7ff8a7b0dc4c,0x7ff8a7b0dc58
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe "c:\program files\avg\browser\application\avgbrowser.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaeaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --field-trial-handle=2124,i,2166630059599507292,14770330184015614422,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:2
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe "c:\program files\avg\browser\application\avgbrowser.exe" --type=crashpad-handler --user-data-dir=c:\users\user\appdata\local\temp\\heartbeat8128_116327840 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=c:\users\user\appdata\local\temp\\heartbeat8128_116327840\crashpad --url=fake_url --annotation=plat=win64 --annotation=prod=avg --annotation=ver=124.0.25069.209 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8a7b0dc40,0x7ff8a7b0dc4c,0x7ff8a7b0dc58
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeProcess created: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe "c:\program files\avg\browser\application\avgbrowser.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaeaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --field-trial-handle=2028,i,14563547802735666349,826896251076988020,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B17650 GetSecurityDescriptorDacl,InitializeSecurityDescriptor,GetAclInformation,SetSecurityDescriptorDacl,_invalid_parameter_noinfo,9_2_00007FF677B17650
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeCode function: 4_2_00B15825 cpuid 4_2_00B15825
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,9_2_00007FF677B52904
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: GetLocaleInfoW,9_2_00007FF677B53004
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: GetLocaleInfoW,9_2_00007FF677B4C6F0
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,9_2_00007FF677B52DB8
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: EnumSystemLocalesW,9_2_00007FF677B52D20
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: EnumSystemLocalesW,9_2_00007FF677B52C50
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,9_2_00007FF677B53338
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: EnumSystemLocalesW,9_2_00007FF677B4C26C
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: GetLocaleInfoW,9_2_00007FF677B5320C
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,9_2_00007FF677B5315C
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: EnumSystemLocalesW,30_2_00007FF69105C248
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: EnumSystemLocalesW,30_2_00007FF691060AAC
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: EnumSystemLocalesW,30_2_00007FF691060DC8
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: GetLocaleInfoW,30_2_00007FF69105B5D4
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,30_2_00007FF691061058
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,30_2_00007FF6910607AC
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exeQueries volume information: C:\Program Files\AVG\Browser\Application\initial_preferences VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files\AVG\Browser\Application\initial_preferences VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files\AVG\Browser\Application\124.0.25069.209\MEIPreload\manifest.json VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files\Google\Chrome\Application\chrome.exe VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files\AVG\Browser\Application\124.0.25069.209\MEIPreload\preloaded_data.pb VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files\AVG\Browser\Application\initial_preferences VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files\AVG\Browser\Application\124.0.25069.209\MEIPreload\manifest.json VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files\AVG\Browser\Application\initial_preferences VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files\AVG\Browser\Application\initial_preferences VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Preferences VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files\AVG\Browser\Application\initial_preferences VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files\AVG\Browser\Application\124.0.25069.209\MEIPreload\manifest.json VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files\AVG\Browser\Application\initial_preferences VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files\Google\Chrome\Application\chrome.exe VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\MSACCESS.EXE VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files\Mozilla Firefox\private_browsing.exe VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files\Mozilla Firefox\firefox.exe VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Windows\System32\control.exe VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\MSPUB.EXE VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Users\user\AppData\Local\Temp\377cc4f8-0c1a-49d4-a7d3-dc885f2ebb50.tmp VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files\Google\Chrome\Application\chrome.exe VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe VolumeInformation
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeQueries volume information: C:\Program Files\AVG\Browser\Application\124.0.25069.209\MEIPreload\preloaded_data.pb VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exeCode function: 4_2_00B1546C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,4_2_00B1546C
Source: C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exeCode function: 9_2_00007FF677B4D90C _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,9_2_00007FF677B4D90C
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeCode function: 30_2_00007FF690FED2C0 _Init_thread_header,GetVersionExW,GetProductInfo,_Init_thread_header,GetNativeSystemInfo,30_2_00007FF690FED2C0
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGBrowserUpdate.exe DisableExceptionChainValidationJump to behavior

Stealing of Sensitive Information

barindex
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\search.json.mozlz4Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\HistoryJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\ProfilesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PreferencesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqliteJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HistoryJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-releaseJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ajF04F.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\DefaultJump to behavior
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeFile opened: C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\History
Source: C:\Program Files\AVG\Browser\Application\AVGBrowser.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire Infrastructure1
Replication Through Removable Media		1
Windows Management Instrumentation		1
DLL Side-Loading		1
DLL Side-Loading		1
Disable or Modify Tools		1
OS Credential Dumping		2
System Time Discovery		Remote Services1
Archive Collected Data		1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts231
Native API		1
Image File Execution Options Injection		1
Image File Execution Options Injection		1
Deobfuscate/Decode Files or Information		LSASS Memory1
Account Discovery		Remote Desktop Protocol1
Data from Local System		Junk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts13
Command and Scripting Interpreter		1
Windows Service		1
Windows Service		2
Obfuscated Files or Information		Security Account Manager11
Peripheral Device Discovery		SMB/Windows Admin Shares2
Clipboard Data		SteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal Accounts1
Scheduled Task/Job		1
Scheduled Task/Job		111
Process Injection		1
DLL Side-Loading		NTDS3
File and Directory Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchd21
Registry Run Keys / Startup Folder		1
Scheduled Task/Job		1
File Deletion		LSA Secrets166
System Information Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts21
Registry Run Keys / Startup Folder		13
Masquerading		Cached Domain Credentials1
Query Registry		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items14
Virtualization/Sandbox Evasion		DCSync271
Security Software Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job111
Process Injection		Proc Filesystem14
Virtualization/Sandbox Evasion		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAtHTML Smuggling/etc/passwd and /etc/shadow1
Process Discovery		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCronDynamic API ResolutionNetwork Sniffing1
Application Window Discovery		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchdStripped PayloadsInput Capture1
Remote System Discovery		Software Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1451180 Sample: file.exe Startdate: 03/06/2024 Architecture: WINDOWS Score: 40 139 Malicious sample detected (through community Yara rule) 2->139 141 Found evasive API chain (may stop execution after checking volume information) 2->141 143 Contains functionality to prevent local Windows debugging 2->143 10 file.exe 65 2->10         started        13 AVGBrowserUpdate.exe 2->13         started        17 AVGBrowser.exe 2->17         started        19 9 other processes 2->19 process3 dnsIp4 113 C:\Users\user\AppData\Local\Temp\ajF04F.exe, PE32 10->113 dropped 115 C:\Users\user\AppData\Local\Temp\...\scrt.dll, PE32 10->115 dropped 117 C:\Users\user\AppData\...\thirdparty.dll, PE32 10->117 dropped 125 10 other files (none is malicious) 10->125 dropped 21 ajF04F.exe 39 106 10->21         started        133 2.16.164.59 AKAMAI-ASN1EU European Union 13->133 119 C:\...\AVGBrowserInstaller.exe, PE32+ 13->119 dropped 121 {1FF43E4D-AA88-447...rowserInstaller.exe, PE32+ 13->121 dropped 123 C:\...\AVGBrowserInstaller.exe, PE32+ 13->123 dropped 169 Query firmware table information (likely to detect VMs) 13->169 26 AVGBrowserInstaller.exe 13->26         started        28 AVGBrowserCrashHandler.exe 13->28         started        30 AVGBrowserCrashHandler64.exe 13->30         started        32 AVGBrowser.exe 17->32         started        135 184.28.90.27 AKAMAI-ASUS United States 19->135 137 127.0.0.1 unknown unknown 19->137 34 AVGBrowser.exe 19->34         started        36 AVGBrowserUpdate.exe 19->36         started        38 AVGBrowserUpdate.exe 19->38         started        file5 signatures6 process7 dnsIp8 129 104.20.87.8 CLOUDFLARENETUS United States 21->129 77 C:\Users\user\...\AVGBrowserUpdateSetup.exe, PE32 21->77 dropped 79 C:\Users\user\AppData\...\thirdparty.dll, PE32 21->79 dropped 81 C:\Users\user\AppData\Local\...\sciterui.dll, PE32 21->81 dropped 85 10 other files (none is malicious) 21->85 dropped 145 Query firmware table information (likely to detect VMs) 21->145 147 Tries to harvest and steal browser information (history, passwords, etc) 21->147 149 Checks if the current machine is a virtual machine (disk enumeration) 21->149 40 AVGBrowserUpdateSetup.exe 78 21->40         started        44 AVGBrowser.exe 21->44         started        83 C:\Program Files (x86)\AVG\...\setup.exe, PE32+ 26->83 dropped 46 setup.exe 26->46         started        131 239.255.255.250 unknown Reserved 32->131 151 Creates multiple autostart registry keys 32->151 48 AVGBrowser.exe 32->48         started        50 AVGBrowser.exe 32->50         started        52 AVGBrowser.exe 34->52         started        54 AVGBrowser.exe 34->54         started        file9 signatures10 process11 file12 87 C:\...\AVGBrowserUpdate.exe, PE32 40->87 dropped 89 C:\Program Files (x86)\...\psuser_64.dll, PE32+ 40->89 dropped 91 C:\Program Files (x86)\...\psuser.dll, PE32 40->91 dropped 103 69 other files (none is malicious) 40->103 dropped 153 Found evasive API chain checking for user administrative privileges 40->153 56 AVGBrowserUpdate.exe 74 80 40->56         started        93 C:\Users\user\AppData\Local\AVG\...\History, SQLite 44->93 dropped 155 Query firmware table information (likely to detect VMs) 44->155 157 Creates multiple autostart registry keys 44->157 159 Tries to harvest and steal browser information (history, passwords, etc) 44->159 161 Checks if the current machine is a virtual machine (disk enumeration) 44->161 95 C:\Program Files\AVG\Browser\...\chrome.dll, PE32+ 46->95 dropped 97 C:\...\browser_crash_reporter.exe, PE32+ 46->97 dropped 99 C:\Program Files\...\aswEngineConnector.dll, PE32+ 46->99 dropped 101 C:\...\AVGBrowserProtect.exe (copy), PE32+ 46->101 dropped 163 Creates an undocumented autostart registry key 46->163 60 setup.exe 46->60         started        signatures13 process14 file15 105 C:\...\AVGBrowserUpdate.exe, PE32 56->105 dropped 107 C:\...\AVGBrowserUpdateComRegisterShell64.exe, PE32+ 56->107 dropped 109 C:\Program Files (x86)\AVG\...\psuser_64.dll, PE32+ 56->109 dropped 111 70 other files (none is malicious) 56->111 dropped 165 Query firmware table information (likely to detect VMs) 56->165 167 Creates an undocumented autostart registry key 56->167 62 AVGBrowserUpdate.exe 56->62         started        64 AVGBrowserUpdate.exe 56->64         started        67 AVGBrowserUpdate.exe 49 56->67         started        69 AVGBrowserUpdate.exe 56->69         started        signatures16 process17 dnsIp18 71 AVGBrowserUpdateComRegisterShell64.exe 62->71         started        73 AVGBrowserUpdateComRegisterShell64.exe 62->73         started        75 AVGBrowserUpdateComRegisterShell64.exe 62->75         started        127 172.67.41.145 CLOUDFLARENETUS United States 64->127 process19

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
file.exe8%ReversingLabs

Dropped Files

SourceDetectionScannerLabelLink
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdate.exe0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateBroker.exe0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateCore.exe0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateOnDemand.exe0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateSetup.exe0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateWebPlugin.exe0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\acuapi.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\acuapi_64.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdate.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_am.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ar.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_bg.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_bn.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ca.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_cs.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_da.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_de.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_el.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_en-GB.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_en.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_es-419.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_es.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_et.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_fa.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_fi.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_fil.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_fr.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_gu.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_hi.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_hr.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_hu.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_id.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_is.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_it.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_iw.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ja.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_kn.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ko.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_lt.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_lv.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ml.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_mr.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ms.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_nl.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_no.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_pl.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_pt-BR.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_pt-PT.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ro.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ru.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_sk.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_sl.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_sr.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_sv.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_sw.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ta.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_te.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_th.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_tr.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_uk.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ur.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_vi.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_zh-CN.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_zh-TW.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\npAvgBrowserUpdate3.dll0%ReversingLabs
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\psmachine.dll0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://anglebug.com/46330%URL Reputationsafe
https://anglebug.com/73820%URL Reputationsafe
https://issuetracker.google.com/2844622630%URL Reputationsafe
https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new0%URL Reputationsafe
https://anglebug.com/77140%URL Reputationsafe
http://unisolated.invalid/0%URL Reputationsafe
http://anglebug.com/62480%URL Reputationsafe
http://anglebug.com/69290%URL Reputationsafe
http://anglebug.com/52810%URL Reputationsafe
https://issuetracker.google.com/2554117480%URL Reputationsafe
https://crashpad.chromium.org/0%URL Reputationsafe
https://anglebug.com/72460%URL Reputationsafe
https://anglebug.com/73690%URL Reputationsafe
https://anglebug.com/74890%URL Reputationsafe
https://drive-daily-2.corp.google.com/0%URL Reputationsafe
https://issuetracker.google.com/1619030060%URL Reputationsafe
https://drive-daily-1.corp.google.com/0%URL Reputationsafe
https://drive-daily-5.corp.google.com/0%URL Reputationsafe
http://anglebug.com/30780%URL Reputationsafe
http://anglebug.com/75530%URL Reputationsafe
http://anglebug.com/53750%URL Reputationsafe
http://anglebug.com/53710%URL Reputationsafe
http://anglebug.com/47220%URL Reputationsafe
http://anglebug.com/75560%URL Reputationsafe
https://drive-preprod.corp.google.com/0%URL Reputationsafe
http://anglebug.com/66920%URL Reputationsafe
https://issuetracker.google.com/2582074030%URL Reputationsafe
http://anglebug.com/35020%URL Reputationsafe
http://anglebug.com/36230%URL Reputationsafe
http://anglebug.com/36250%URL Reputationsafe
http://anglebug.com/36240%URL Reputationsafe
https://crashpad.chromium.org/bug/new0%URL Reputationsafe
http://anglebug.com/50070%URL Reputationsafe
http://anglebug.com/38620%URL Reputationsafe
http://www.avast.com0/0%URL Reputationsafe
http://anglebug.com/48360%URL Reputationsafe
https://issuetracker.google.com/issues/1664752730%URL Reputationsafe
http://anglebug.com/43840%URL Reputationsafe
http://anglebug.com/39700%URL Reputationsafe
https://anglebug.com/76040%URL Reputationsafe
http://anglebug.com/77610%URL Reputationsafe
http://anglebug.com/77600%URL Reputationsafe
http://anglebug.com/59010%URL Reputationsafe
http://anglebug.com/39650%URL Reputationsafe
http://anglebug.com/64390%URL Reputationsafe
http://anglebug.com/74060%URL Reputationsafe
https://anglebug.com/71610%URL Reputationsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://engagement-content.avastbrowser.com/94047/illustration.svgAVGBrowser.exe, 0000001D.00000003.3045716415.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpfalse
    		unknown
    https://www.yahoo.com/favicon.icohttps://ch.search.yahoo.com/yhs/searchAVGBrowser.exe, 0000001C.00000003.3000072043.00001B1C02D40000.00000004.00001000.00020000.00000000.sdmpfalse
      		unknown
      https://update.avgbrowser.com/VAVGBrowserUpdate.exe, 0000000D.00000002.2285893864.0000000000D5C000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 0000000D.00000003.2281016026.0000000000D5C000.00000004.00000020.00020000.00000000.sdmpfalse
        		unknown
        http://anglebug.com/4633AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
        • URL Reputation: safe
        		unknown
        https://anglebug.com/7382AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
        • URL Reputation: safe
        		unknown
        https://issuetracker.google.com/284462263AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
        • URL Reputation: safe
        		unknown
        http://www.avast.com1.2.840.113549.1.9.4ajF04F.exe, 00000003.00000003.2108302657.0000000004491000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2926022679.00000000044A0000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2925888033.00000000044A0000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2108426382.0000000004499000.00000004.00000020.00020000.00000000.sdmpfalse
          		unknown
          https://search.yahoo.com/yhs/searchAVGBrowser.exe, 0000001C.00000003.3000072043.00001B1C02D40000.00000004.00001000.00020000.00000000.sdmpfalse
            		unknown
            https://support.avg.com/SupportArticleView?l=en&urlName=avg-secure-browser-faq&q=coupons&supportTypeAVGBrowser.exe, 0000001C.00000003.3046330607.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011991588.00001B1C02E30000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3027804980.00001B1C029E4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986448715.00000FDC02E0C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.3045716415.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpfalse
              		unknown
              http://browser-update.avg.com/browser-avg/win/x64/124.0.25069.209/AVGBrowserInstaller.exeamAVGBrowserUpdate.exe, 00000012.00000002.2899056963.00000000031A0000.00000004.00000020.00020000.00000000.sdmpfalse
                		unknown
                https://crashpad.chromium.org/https://crashpad.chromium.org/bug/newsetup.exe, 00000017.00000002.2873586684.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, setup.exe, 00000017.00000000.2539988971.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, setup.exe, 00000018.00000002.2876710388.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, setup.exe, 00000018.00000000.2544840578.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, AVGBrowser.exe, 0000001A.00000000.2869521627.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001B.00000000.2872124493.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001C.00000000.2875770965.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001D.00000000.2876092036.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001E.00000000.2878831708.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001F.00000002.2896650039.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001F.00000000.2879064714.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpfalse
                • URL Reputation: safe
                		unknown
                https://docs.google.com/ajF04F.exe, 00000003.00000003.2074644451.00000000007A8000.00000004.00000020.00020000.00000000.sdmpfalse
                  		unknown
                  https://anglebug.com/7714AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://unisolated.invalid/AVGBrowser.exe, 0000001D.00000003.2950597680.00000FDC029A0000.00000004.00001000.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://anglebug.com/6248AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://addons.avg.securebrowser.comAVGBrowser.exe, 0000001C.00000003.3012102665.00001B1C029B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012296585.00001B1C02E6C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012199682.00001B1C02934000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3017727475.00001B1C02C60000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012373557.00001B1C02E80000.00000004.00001000.00020000.00000000.sdmpfalse
                    		unknown
                    http://anglebug.com/6929AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    https://update.avgbrowser.com/adblock/assets/v3/filter_whitelist.txtAVGBrowser.exe, 0000001C.00000003.2981624358.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3047052872.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011651551.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmpfalse
                      		unknown
                      http://anglebug.com/5281AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://issuetracker.google.com/255411748AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://crashpad.chromium.org/setup.exe, 00000017.00000002.2873586684.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, setup.exe, 00000017.00000000.2539988971.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, setup.exe, 00000018.00000002.2876710388.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, setup.exe, 00000018.00000000.2544840578.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, AVGBrowser.exe, 0000001A.00000000.2869521627.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001B.00000000.2872124493.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001C.00000000.2875770965.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001D.00000000.2876092036.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001E.00000000.2878831708.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001F.00000002.2896650039.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001F.00000000.2879064714.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://anglebug.com/7246AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://anglebug.com/7369AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://anglebug.com/7489AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://beta-onboarding.avira.securebrowser.comAVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpfalse
                        		unknown
                        https://config.ccleaner.securebrowser.comAVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpfalse
                          		unknown
                          https://chrome.google.com/webstoreAVGBrowser.exe, 0000001C.00000003.3012373557.00001B1C02E80000.00000004.00001000.00020000.00000000.sdmpfalse
                            		unknown
                            http://anglebug.com/8417AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                              		unknown
                              https://drive-daily-2.corp.google.com/ajF04F.exe, 00000003.00000003.2074644451.00000000007A8000.00000004.00000020.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              https://www.startpage.com/en/how-startpage-worksAVGBrowser.exe, 0000001C.00000003.3046330607.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011991588.00001B1C02E30000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986448715.00000FDC02E0C000.00000004.00001000.00020000.00000000.sdmpfalse
                                		unknown
                                https://issuetracker.google.com/161903006AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                https://drive-daily-1.corp.google.com/ajF04F.exe, 00000003.00000003.2074644451.00000000007A8000.00000004.00000020.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                https://easylist-downloads.adblockplus.org/easylist.txtAVGBrowser.exe, 0000001C.00000003.3047052872.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011651551.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmpfalse
                                  		unknown
                                  https://drive-daily-5.corp.google.com/ajF04F.exe, 00000003.00000003.2074644451.00000000007A8000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  https://dev-onboarding.avira.securebrowser.comAVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpfalse
                                    		unknown
                                    https://dev-onboarding.norton.securebrowser.comAVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpfalse
                                      		unknown
                                      http://anglebug.com/3078AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://anglebug.com/7553AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://anglebug.com/5375AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      https://issuetracker.google.com/155487768AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                        		unknown
                                        https://update.avgbrowser.com/AVGBrowserUpdate.exe, 00000010.00000003.2242142015.0000000000CAB000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000010.00000002.2244872340.0000000000CAB000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000002.2897358431.0000000001571000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000003.2889037888.0000000001571000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		unknown
                                          https://www.startpage.com/sp/cdn/images/startpage-logo-new.svgAVGBrowser.exe, 0000001C.00000003.2981624358.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011651551.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmpfalse
                                            		unknown
                                            http://anglebug.com/5371AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            https://update.avgbrowser.com/service/update2?cup2key=9:1470396613&cup2hreq=9946070338cefa8ad493aa8cAVGBrowserUpdate.exe, 00000012.00000003.2895005428.000000000159E000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000003.2891305776.0000000001537000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000002.2897358431.0000000001571000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000003.2895370553.0000000001537000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000003.2892228142.000000000159C000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000002.2897153726.0000000001537000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000003.2889037888.0000000001571000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000002.2897780593.00000000015A0000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		unknown
                                              http://anglebug.com/4722AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              https://addons.avast.securebrowser.comAVGBrowser.exe, 0000001C.00000003.3012102665.00001B1C029B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012296585.00001B1C02E6C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012199682.00001B1C02934000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3017727475.00001B1C02C60000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012373557.00001B1C02E80000.00000004.00001000.00020000.00000000.sdmpfalse
                                                		unknown
                                                https://easylist-downloads.adblockplus.org/exceptionrules.txtAVGBrowser.exe, 0000001C.00000003.3047052872.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011651551.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmpfalse
                                                  		unknown
                                                  https://addons.avast.com/AVGBrowser.exe, 0000001C.00000003.3012102665.00001B1C029B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012296585.00001B1C02E6C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012199682.00001B1C02934000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3017727475.00001B1C02C60000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012373557.00001B1C02E80000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    		unknown
                                                    https://easylist-downloads.adblockplus.org/abpvnAVGBrowser.exe, 0000001C.00000003.3047052872.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011651551.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      		unknown
                                                      https://engagement-content.avastbrowser.com/79015/pg_indicator_on_dark.svgAVGBrowser.exe, 0000001C.00000003.3046330607.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011991588.00001B1C02E30000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986448715.00000FDC02E0C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        		unknown
                                                        https://engagement-content.avastbrowser.com/94625/icon_avira.svgAVGBrowser.exe, 0000001D.00000003.3045716415.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpfalse
                                                          		unknown
                                                          http://anglebug.com/7556AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                          • URL Reputation: safe
                                                          		unknown
                                                          https://addons.norton.securebrowser.com1)https://test-browser-addons.svc.avast.comQIDiscoverAVGBrowser.exe, 0000001C.00000003.3012102665.00001B1C029B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012296585.00001B1C02E6C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012199682.00001B1C02934000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3017727475.00001B1C02C60000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012373557.00001B1C02E80000.00000004.00001000.00020000.00000000.sdmpfalse
                                                            		unknown
                                                            https://drive-preprod.corp.google.com/ajF04F.exe, 00000003.00000003.2074644451.00000000007A8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            https://onboarding.ccleaner.securebrowser.comAVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpfalse
                                                              		unknown
                                                              https://easylist-downloads.adblockplus.org/abpindoAVGBrowser.exe, 0000001C.00000003.2981624358.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3047052872.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011651551.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                		unknown
                                                                https://addons.avg.securebrowser.com1)https://addons.ccleaner.securebrowser.com.&https://addons.avirAVGBrowser.exe, 0000001C.00000003.3012102665.00001B1C029B8000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012296585.00001B1C02E6C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012199682.00001B1C02934000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3017727475.00001B1C02C60000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3012373557.00001B1C02E80000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                  		unknown
                                                                  https://dev-config.avast.securebrowser.comAVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                    		unknown
                                                                    https://gemini.google.com/app?q=AVGBrowser.exe, 0000001C.00000003.3047803586.00001B1C02AD0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                      		unknown
                                                                      http://anglebug.com/6692AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                      • URL Reputation: safe
                                                                      		unknown
                                                                      https://issuetracker.google.com/258207403AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                      • URL Reputation: safe
                                                                      		unknown
                                                                      https://stats.securebrowser.com/NajF04F.exe, 00000003.00000003.2099462467.000000000395A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		unknown
                                                                        http://anglebug.com/3502AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                        • URL Reputation: safe
                                                                        		unknown
                                                                        http://anglebug.com/3623AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                        • URL Reputation: safe
                                                                        		unknown
                                                                        http://anglebug.com/3625AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                        • URL Reputation: safe
                                                                        		unknown
                                                                        http://anglebug.com/3624AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                        • URL Reputation: safe
                                                                        		unknown
                                                                        https://crashpad.chromium.org/bug/newsetup.exe, 00000017.00000002.2873586684.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, setup.exe, 00000017.00000000.2539988971.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, setup.exe, 00000018.00000002.2876710388.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, setup.exe, 00000018.00000000.2544840578.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmp, AVGBrowser.exe, 0000001A.00000000.2869521627.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001B.00000000.2872124493.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001C.00000000.2875770965.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001D.00000000.2876092036.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001E.00000000.2878831708.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001F.00000002.2896650039.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmp, AVGBrowser.exe, 0000001F.00000000.2879064714.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpfalse
                                                                        • URL Reputation: safe
                                                                        		unknown
                                                                        https://engagement-content.avastbrowser.com/94055/illustration-3.svgAVGBrowser.exe, 0000001D.00000003.3045716415.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          		unknown
                                                                          http://anglebug.com/5007AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          • URL Reputation: safe
                                                                          		unknown
                                                                          https://engagement-content.avastbrowser.com/79014/pg_indicator_on_light.svgAVGBrowser.exe, 0000001C.00000003.3046330607.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011991588.00001B1C02E30000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986448715.00000FDC02E0C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                            		unknown
                                                                            http://anglebug.com/3862AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                            • URL Reputation: safe
                                                                            		unknown
                                                                            https://beta-config.avira.securebrowser.comAVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                              		unknown
                                                                              http://www.avast.com0/ajF04F.exe, 00000003.00000003.2920688630.0000000003973000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2108302657.0000000004491000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002AAB000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000441A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030D6000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000042C3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044A3000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.000000000446A000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003977000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.00000000044F4000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000002B23000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2116230812.0000000004431000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030C0000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000396C000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.000000000326F000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003B07000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.00000000038CC000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2119106262.0000000003A72000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.0000000003239000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdateSetup.exe, 00000004.00000003.2112481989.00000000031E9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              • URL Reputation: safe
                                                                              		unknown
                                                                              http://anglebug.com/4836AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                              • URL Reputation: safe
                                                                              		unknown
                                                                              https://issuetracker.google.com/issues/166475273AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                              • URL Reputation: safe
                                                                              		unknown
                                                                              https://support.norton.com/sp/en/us/home/current/solutions/v2023031322263778AVGBrowser.exe, 0000001C.00000003.3046330607.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011991588.00001B1C02E30000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3027804980.00001B1C029E4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986448715.00000FDC02E0C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.3045716415.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                		unknown
                                                                                http://anglebug.com/4384AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                • URL Reputation: safe
                                                                                		unknown
                                                                                http://browser-update.avg.com/browser-avg/win/x64/124.0.25069.209/AVGBrowserUpdate.exe, 00000012.00000003.2895005428.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000002.2897412994.0000000001582000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000012.00000003.2888337213.0000000002950000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		unknown
                                                                                  https://easylist-downloads.adblockplus.org/abp-filters-anti-cv.txttAVGBrowser.exe, 0000001C.00000003.2981624358.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011651551.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                    		unknown
                                                                                    https://issuetracker.google.com/309028728AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                      		unknown
                                                                                      http://anglebug.com/3970AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                      • URL Reputation: safe
                                                                                      		unknown
                                                                                      http://anglebug.com/8503AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                        		unknown
                                                                                        https://config.avast.securebrowser.comAVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                          		unknown
                                                                                          https://engagement-content.avastbrowser.com/94626/icon_avg.pngAVGBrowser.exe, 0000001D.00000003.3045716415.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                            		unknown
                                                                                            https://update.avgbrowser.com/service/update2sAVGBrowserUpdate.exe, 0000000D.00000002.2284690621.0000000000D25000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		unknown
                                                                                              https://beta-onboarding.avg.securebrowser.comAVGBrowser.exe, 0000001D.00000003.2985955121.00000FDC02A44000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                		unknown
                                                                                                https://stats.securebrowser.com/?_=1717427700642&retry_tracking_count=0&last_request_error_code=0&laajF04F.exe, 00000003.00000003.2099462467.000000000395A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		unknown
                                                                                                  https://update.avgbrowser.com/service/update2~AVGBrowserUpdate.exe, 00000010.00000003.2242142015.0000000000CC0000.00000004.00000020.00020000.00000000.sdmp, AVGBrowserUpdate.exe, 00000010.00000002.2244872340.0000000000CC0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		unknown
                                                                                                    https://anglebug.com/7604AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                    • URL Reputation: safe
                                                                                                    		unknown
                                                                                                    http://anglebug.com/7761AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                    • URL Reputation: safe
                                                                                                    		unknown
                                                                                                    http://www.avast.comajF04F.exe, 00000003.00000003.2108302657.0000000004491000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2926022679.00000000044A0000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2925888033.00000000044A0000.00000004.00000020.00020000.00000000.sdmp, ajF04F.exe, 00000003.00000003.2108426382.0000000004499000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		unknown
                                                                                                      http://anglebug.com/7760AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                      • URL Reputation: safe
                                                                                                      		unknown
                                                                                                      http://anglebug.com/8297AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                        		unknown
                                                                                                        https://www.google.com/images/branding/product/ico/googleg_lodp.icoAVGBrowser.exe, 0000001C.00000003.2981624358.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011651551.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                          		unknown
                                                                                                          http://anglebug.com/5901AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                          • URL Reputation: safe
                                                                                                          		unknown
                                                                                                          https://easylist-downloads.adblockplus.org/abp-filters-anti-cv.txtAVGBrowser.exe, 0000001C.00000003.2981624358.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011651551.00001B1C02B80000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                            		unknown
                                                                                                            http://anglebug.com/3965AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                            • URL Reputation: safe
                                                                                                            		unknown
                                                                                                            http://anglebug.com/6439AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                            • URL Reputation: safe
                                                                                                            		unknown
                                                                                                            http://anglebug.com/7406AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                            • URL Reputation: safe
                                                                                                            		unknown
                                                                                                            https://anglebug.com/7161AVGBrowser.exe, 0000001C.00000003.3011819534.00001B1C02DC4000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001C.00000003.3011748371.00001B1C0253C000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986176559.00000FDC02550000.00000004.00001000.00020000.00000000.sdmp, AVGBrowser.exe, 0000001D.00000003.2986258984.00000FDC02DA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                            • URL Reputation: safe
                                                                                                            		unknown

                                                                                                            World Map of Contacted IPs

                                                                                                            • No. of IPs < 25%
                                                                                                            • 25% < No. of IPs < 50%
                                                                                                            • 50% < No. of IPs < 75%
                                                                                                            • 75% < No. of IPs

                                                                                                            Public IPs

                                                                                                            IPDomainCountryFlagASNASN NameMalicious
                                                                                                            172.67.41.145
                                                                                                            		unknownUnited States
                                                                                                            		13335CLOUDFLARENETUSfalse
                                                                                                            2.16.164.59
                                                                                                            		unknownEuropean Union
                                                                                                            		20940AKAMAI-ASN1EUfalse
                                                                                                            239.255.255.250
                                                                                                            		unknownReserved
                                                                                                            		unknownunknownfalse
                                                                                                            184.28.90.27
                                                                                                            		unknownUnited States
                                                                                                            		16625AKAMAI-ASUSfalse
                                                                                                            104.20.87.8
                                                                                                            		unknownUnited States
                                                                                                            		13335CLOUDFLARENETUSfalse

                                                                                                            Private

                                                                                                            IP
                                                                                                            127.0.0.1

                                                                                                            General Information

                                                                                                            Joe Sandbox version:40.0.0 Tourmaline
                                                                                                            Analysis ID:1451180
                                                                                                            Start date and time:2024-06-03 17:14:05 +02:00
                                                                                                            Joe Sandbox product:CloudBasic
                                                                                                            Overall analysis duration:0h 13m 0s
                                                                                                            Hypervisor based Inspection enabled:false
                                                                                                            Report type:full
                                                                                                            Cookbook file name:default.jbs
                                                                                                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                            Number of analysed new started processes analysed:40
                                                                                                            Number of new started drivers analysed:0
                                                                                                            Number of existing processes analysed:0
                                                                                                            Number of existing drivers analysed:0
                                                                                                            Number of injected processes analysed:0
                                                                                                            Technologies:
                                                                                                            • HCA enabled
                                                                                                            • EGA enabled
                                                                                                            • AMSI enabled
                                                                                                            Analysis Mode:default
                                                                                                            Analysis stop reason:Timeout
                                                                                                            Sample name:file.exe
                                                                                                            Detection:MAL
                                                                                                            Classification:mal40.spyw.evad.winEXE@82/560@0/6
                                                                                                            EGA Information:
                                                                                                            • Successful, ratio: 66.7%
                                                                                                            HCA Information:Failed
                                                                                                            Cookbook Comments:
                                                                                                            • Found application associated with file extension: .exe

                                                                                                            Warnings

                                                                                                            • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                                                                                                            • Execution Graph export aborted for target AVGBrowserUpdate.exe, PID 2636 because there are no executed function
                                                                                                            • Execution Graph export aborted for target AVGBrowserUpdate.exe, PID 7348 because there are no executed function
                                                                                                            • Execution Graph export aborted for target elevation_service.exe, PID 5856 because there are no executed function
                                                                                                            • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                            • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                            • Report size getting too big, too many NtCreateKey calls found.
                                                                                                            • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                            • Report size getting too big, too many NtEnumerateValueKey calls found.
                                                                                                            • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                            • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                            • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                            • Skipping network analysis since amount of network traffic is too extensive
                                                                                                            • VT rate limit hit for: file.exe

                                                                                                            Simulations

                                                                                                            Behavior and APIs

                                                                                                            TimeTypeDescription
                                                                                                            11:14:55API Interceptor2x Sleep call for process: svchost.exe modified
                                                                                                            11:15:16API Interceptor2x Sleep call for process: AVGBrowserUpdate.exe modified
                                                                                                            17:15:11Task SchedulerRun new task: AVGUpdateTaskMachineCore path: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe s>/c
                                                                                                            17:15:11Task SchedulerRun new task: AVGUpdateTaskMachineUA path: C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe s>/ua /installsource scheduler
                                                                                                            17:16:18Task SchedulerRun new task: AVG Secure Browser Heartbeat Task (Hourly) path: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe s>--type=heartbeat --hourly
                                                                                                            17:16:19Task SchedulerRun new task: AVG Secure Browser Heartbeat Task (Logon) path: C:\Program Files\AVG\Browser\Application\AVGBrowser.exe s>--type=heartbeat --logon
                                                                                                            17:16:31AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run AVGBrowserAutoLaunch_726B817271C484847A690E2C1C98BF60 "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --check-run=src=logon --auto-launch-at-startup --profile-directory="Default"
                                                                                                            17:16:40AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run AVGBrowserAutoLaunch_53F4AD9791D53E4F31988DF26A2B411E "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --check-run=src=logon --auto-launch-at-startup --profile-directory="Default"
                                                                                                            17:16:48AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run AVGBrowserAutoLaunch_6124C6D99F5330FF26FB94C49688230C "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --check-run=src=logon --auto-launch-at-startup --profile-directory="Default"
                                                                                                            17:16:54Task SchedulerRun new task: AVGBrowserProtectS-1-5-21-2246122658-3693405117-2476756634-1003 path: C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe s>--runonce
                                                                                                            17:16:56AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run AVGBrowserAutoLaunch_726B817271C484847A690E2C1C98BF60 "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --check-run=src=logon --auto-launch-at-startup --profile-directory="Default"

                                                                                                            Joe Sandbox View / Context

                                                                                                            IPs

                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                            172.67.41.145SecuriteInfo.com.Trojan.InstallCore.4077.7832.32635.exeGet hashmaliciousPureLog StealerBrowse
                                                                                                              avg_secure_browser_setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                utweb_installer.exeGet hashmaliciousMars StealerBrowse
                                                                                                                  utweb_installer.exeGet hashmaliciousMars Stealer, VidarBrowse
                                                                                                                    239.255.255.250https://c2hcr321.caspio.com/dp/20ced00016e9653b00c2435d8109Get hashmaliciousUnknownBrowse
                                                                                                                      20ced00016e9653b00c2435d8109.htmGet hashmaliciousUnknownBrowse
                                                                                                                        https://engaging-activity-ac4ca3f199.media.strapiapp.com/33_5711a9a219.html#abc@gmail.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                          https://engaging-activity-ac4ca3f199.media.strapiapp.com/33_5711a9a219.html#tracey_kroboth@condenast.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                            https://secure.adpucm.com/adpwebmanager/preAuth/SearchEmployer?company_code=74972&desired_app=UCX-Case-BuilderGet hashmaliciousUnknownBrowse
                                                                                                                              http://emminentintl.com/utils/set_language.html?lang=en&key=catalog_119329&return_url=https://ips-webmailsquoto.net/rjfkrg/###tom.winney@wfel.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                http://midwestozonegroup.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                  https://afrikikoresort.com/Get hashmaliciousUnknownBrowse
                                                                                                                                    https://muse.krazzykriss.com/Get hashmaliciousUnknownBrowse
                                                                                                                                      https://assets-eur.mkt.dynamics.com/21f9f50d-1320-ef11-8406-000d3adc9e50/digitalassets/standaloneforms/3a7ec846-5e21-ef11-840a-0022489c8b2d?code=FnYBDrD1Get hashmaliciousUnknownBrowse
                                                                                                                                        184.28.90.27Scannable QrCode.docxGet hashmaliciousUnknownBrowse
                                                                                                                                          Ticket (WS455-6593).msgGet hashmaliciousUnknownBrowse
                                                                                                                                            https://download2.easeus.com/installer_rss_new.phpGet hashmaliciousUnknownBrowse
                                                                                                                                              SecuriteInfo.com.Win32.Evo-gen.26431.15713.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, StealcBrowse
                                                                                                                                                Attachments.zipGet hashmaliciousUnknownBrowse
                                                                                                                                                  10478_20_VSW-100_VSC-03_08_4946.msiGet hashmaliciousUnknownBrowse
                                                                                                                                                    Endpoint Agent-x64-1.195.0.msiGet hashmaliciousUnknownBrowse
                                                                                                                                                      n6N8r2RjfaGet hashmaliciousUnknownBrowse
                                                                                                                                                        https://pixeldrain.com/l/fXxFweL2Get hashmaliciousBabadeda, Blank Grabber, OsnoBrowse
                                                                                                                                                          finalshell_windows_x64.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                            104.20.87.8SecuriteInfo.com.Trojan.InstallCore.4086.7598.27088.exeGet hashmaliciousPrivateLoader, PureLog StealerBrowse

                                                                                                                                                              Domains

                                                                                                                                                              ⊘No context

                                                                                                                                                              ASNs

                                                                                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                              AKAMAI-ASN1EUScannable QrCode.docxGet hashmaliciousUnknownBrowse
                                                                                                                                                              • 88.221.110.227
                                                                                                                                                              http://telegrum.xyzGet hashmaliciousUnknownBrowse
                                                                                                                                                              • 95.101.148.20
                                                                                                                                                              Ticket (WS455-6593).msgGet hashmaliciousUnknownBrowse
                                                                                                                                                              • 2.16.164.75
                                                                                                                                                              nxz1JLFrc3.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                              • 23.215.60.30
                                                                                                                                                              https://ledger-sync-extens.pages.dev/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                              • 95.101.148.20
                                                                                                                                                              https://www.of372.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                              • 95.101.148.20
                                                                                                                                                              https://www.cs2ip.net/Get hashmaliciousUnknownBrowse
                                                                                                                                                              • 95.101.149.47
                                                                                                                                                              ls0PnGaKLG.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                              • 95.100.100.184
                                                                                                                                                              wechat-3.9.7-installer_ae-GFz1.exeGet hashmaliciousCoinhive, Crypto Miner, DarkComet, GhostRat, IcedID, LaZagne, Mini RATBrowse
                                                                                                                                                              • 23.197.126.143
                                                                                                                                                              wechat-3.9.7-installer_ae-GFz1.exeGet hashmaliciousPureLog StealerBrowse
                                                                                                                                                              • 104.124.11.8
                                                                                                                                                              CLOUDFLARENETUShttps://c2hcr321.caspio.com/dp/20ced00016e9653b00c2435d8109Get hashmaliciousUnknownBrowse
                                                                                                                                                              • 172.64.154.248
                                                                                                                                                              20ced00016e9653b00c2435d8109.htmGet hashmaliciousUnknownBrowse
                                                                                                                                                              • 1.1.1.1
                                                                                                                                                              https://engaging-activity-ac4ca3f199.media.strapiapp.com/33_5711a9a219.html#abc@gmail.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                              • 104.18.11.207
                                                                                                                                                              https://engaging-activity-ac4ca3f199.media.strapiapp.com/33_5711a9a219.html#tracey_kroboth@condenast.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                              • 104.18.10.207
                                                                                                                                                              SecuriteInfo.com.W32.AutoIt.YE.gen.Eldorado.25325.32677.exeGet hashmaliciousPureLog Stealer, Snake KeyloggerBrowse
                                                                                                                                                              • 188.114.97.3
                                                                                                                                                              http://emminentintl.com/utils/set_language.html?lang=en&key=catalog_119329&return_url=https://ips-webmailsquoto.net/rjfkrg/###tom.winney@wfel.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                              • 104.17.2.184
                                                                                                                                                              03-07-2024 SWIFT.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                                                                                              • 172.67.74.152
                                                                                                                                                              igcc.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                              • 104.26.13.205
                                                                                                                                                              20055.xlsGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                              • 172.67.74.152
                                                                                                                                                              TFMUpLhFq6.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                              • 188.114.96.3
                                                                                                                                                              CLOUDFLARENETUShttps://c2hcr321.caspio.com/dp/20ced00016e9653b00c2435d8109Get hashmaliciousUnknownBrowse
                                                                                                                                                              • 172.64.154.248
                                                                                                                                                              20ced00016e9653b00c2435d8109.htmGet hashmaliciousUnknownBrowse
                                                                                                                                                              • 1.1.1.1
                                                                                                                                                              https://engaging-activity-ac4ca3f199.media.strapiapp.com/33_5711a9a219.html#abc@gmail.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                              • 104.18.11.207
                                                                                                                                                              https://engaging-activity-ac4ca3f199.media.strapiapp.com/33_5711a9a219.html#tracey_kroboth@condenast.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                              • 104.18.10.207
                                                                                                                                                              SecuriteInfo.com.W32.AutoIt.YE.gen.Eldorado.25325.32677.exeGet hashmaliciousPureLog Stealer, Snake KeyloggerBrowse
                                                                                                                                                              • 188.114.97.3
                                                                                                                                                              http://emminentintl.com/utils/set_language.html?lang=en&key=catalog_119329&return_url=https://ips-webmailsquoto.net/rjfkrg/###tom.winney@wfel.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                              • 104.17.2.184
                                                                                                                                                              03-07-2024 SWIFT.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                                                                                              • 172.67.74.152
                                                                                                                                                              igcc.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                              • 104.26.13.205
                                                                                                                                                              20055.xlsGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                              • 172.67.74.152
                                                                                                                                                              TFMUpLhFq6.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                              • 188.114.96.3
                                                                                                                                                              AKAMAI-ASUSPhaser_3117_Win8_32-bit_and_64-bit_GDI.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                              • 2.19.244.127
                                                                                                                                                              Scannable QrCode.docxGet hashmaliciousUnknownBrowse
                                                                                                                                                              • 184.28.90.27
                                                                                                                                                              https://supersimple365.com/microsoft-lists-user-experience-update-mid-2023/Get hashmaliciousUnknownBrowse
                                                                                                                                                              • 23.201.252.227
                                                                                                                                                              https://dawatywmaitzdzmys.weebly.com/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                              • 104.102.48.219
                                                                                                                                                              Ticket (WS455-6593).msgGet hashmaliciousUnknownBrowse
                                                                                                                                                              • 184.28.90.27
                                                                                                                                                              ESjluyNExL.exeGet hashmaliciousVidarBrowse
                                                                                                                                                              • 104.102.42.29
                                                                                                                                                              4xGw66BS5c.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                              • 104.112.24.27
                                                                                                                                                              jboc00A6YP.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                              • 23.7.49.149
                                                                                                                                                              z9BtNf1MSZ.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                              • 184.28.181.110
                                                                                                                                                              https://www.cs2ip.net/Get hashmaliciousUnknownBrowse
                                                                                                                                                              • 2.16.202.57

                                                                                                                                                              JA3 Fingerprints

                                                                                                                                                              ⊘No context

                                                                                                                                                              Dropped Files

                                                                                                                                                              ⊘No context

                                                                                                                                                              Created / dropped Files

                                                                                                                                                              C:\Config.Msi\5d2f0c.rbs

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:modified
                                                                                                                                                              Size (bytes):7820
                                                                                                                                                              Entropy (8bit):5.53496639787323
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:XDzo8euIbvqPXCIMAebvqPXCVMAy/2Ens6FX:X4m/4m/d7
                                                                                                                                                              MD5:5917E5A29FA75A9C274423DCC66F6227
                                                                                                                                                              SHA1:E8BD0F3E91A089DA7063DA896FEBD27E533B4C32
                                                                                                                                                              SHA-256:B58C9B3B8925D22395B3F669C81DC5E8ACAD8EF72BD26BBD061506784C5CE9CC
                                                                                                                                                              SHA-512:37E532F23D4E5ACE7DAEE29E5EA93F41E7AA3C03521BF5BF7E00F68D91BE3E57A39CAB0C2CBB52DCE48688A85B75657BCC517A5C92AC38F99F6B36847448A811
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...@IXOS.@.....@.Y.X.@.....@.....@.....@.....@.....@......&.{EDB7AEE7-E932-4836-AE50-D3B0B7766CB5}..AVG Update Helper..AVGBrowserUpdateHelper.msi.@.....@.....@.....@........&.{A87CFB5C-61CB-4FE0-9552-F287D1928D95}.....@.....@.....@.....@.......@.....@.....@.......@......AVG Update Helper......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{717B7059-A988-492F-AF1B-DCF70BE809AB}&.{EDB7AEE7-E932-4836-AE50-D3B0B7766CB5}.@........WriteRegistryValues..Writing system registry values..Key: [1], Name: [2], Value: [3]$..@......SOFTWARE\AVG\Browser\Update.............................................. ...!.......?........... ... .......?...................?.........................................8......................1.?l.cL<.P...b....~z................. ... ...................$.N.......@....'.&...MsiStubRun..#0....RegisterProduct..Registering product..[1]......C:\Windows\Installer\5d2f0d.msi...

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):152880
                                                                                                                                                              Entropy (8bit):6.814650653995357
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:rPfhJk6XlsbrElrmPARuDnQeH9E3DrhsMslRj53Xh6KlBrUAyDfUgQ1ewnI:bfYKsHKmzJK3DrOMA53Xh7l2/vwn
                                                                                                                                                              MD5:F73E60370EFE16A6D985E564275612DA
                                                                                                                                                              SHA1:2F829A0A611AC7ADD51A6BC50569E75181CDFD58
                                                                                                                                                              SHA-256:9CF076866935A0C64366EFAEFF2EC76D45AC816030EBD616FD5DEFB1870BC30E
                                                                                                                                                              SHA-512:2E44E87C285BB7B72D45C8119D08EA6F2D13CEA77CF0005A3CF530790BB86C7F2DF7C5EDAC9D86C9D7214ABB224738C3BF6B31F6BF104051512BB1DE133042DC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........2R..aR..aR..a...`X..a...`...a...`F..a...`t..a...`C..a...`@..a...`Q..aR..a...a...`S..a..%aS..a...`S..aRichR..a........................PE..L....*.e.....................p......T.............@..........................P............@.................................d'..(....P..............H&.......@......L...T...............................@............................................text............................... ..`.rdata..<].......^..................@..@.data........0....... ..............@....rsrc........P.......*..............@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):174120
                                                                                                                                                              Entropy (8bit):6.56447806246944
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:8zfXhld4VAmlAfFUtpsIiUCm7/rhsMslRj53Xh6KlBrUAyDfUgQPqEZ:2XhP4VHlAfFU57rOMA53Xh7l2/8
                                                                                                                                                              MD5:DEEF1E7382D212CD403431727BE417A5
                                                                                                                                                              SHA1:FAC0E754A5734DD5E9602A0327A66E313F7473BB
                                                                                                                                                              SHA-256:7D410E9EABD086827B16C89EE953A643C3E2F7929616C0AF579253FD8CA60088
                                                                                                                                                              SHA-512:6B472A57FB89B128AAD9AB6313A9CE8B171F7D73264C67F669ADC5CF1F0421D81F654DAD1419B620476ABB59DD54E1AA03A74A26C5C93813F6FB8575FBD97D4D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g0...^...^...^.;v]...^.;v[.U.^.;vZ...^.s[...^.sZ...^.s]...^.;v_...^..._..^.sW...^.s....^.s\...^.Rich..^.........PE..d......e.........."............................@....................................~(....`..................................................l..(...................Hx.../......T...pW..T............................W..8...............@............................text............................... ..`.rdata..............................@..@.data................f..............@....pdata...............r..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..T............p..............@..B................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdate.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):209736
                                                                                                                                                              Entropy (8bit):6.338157428900468
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:IjbidjsOxTePH/lqa8ggDemWSzuwJWwqjPcbhsMslRj53Xh6KlBrUAyDfUgQh7sb:Mtqa8VxJMUbOMA53Xh7l2/64U
                                                                                                                                                              MD5:CBCDF56C8A2788ED761AD3178E2D6E9C
                                                                                                                                                              SHA1:BDEE21667760BC0DF3046D6073A05D779FDC82CB
                                                                                                                                                              SHA-256:E9265A40E5EE5302E8E225EA39A67D452EAAC20370F8B2828340BA079ABBBFD3
                                                                                                                                                              SHA-512:5F68E7DFFDD3424E0EB2E5CD3D05F8B6BA497AAB9408702505341B2C89F265EBB4F9177611D51B9A56629A564431421F3ECB8B25EB08FB2C54DFEDDECB9E9F2E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T.<r..R!..R!..R!..Q ..R!..W ..R!..V ..R!B.V ..R!B.Q ..R!B.W <.R!..S ..R!..S!s.R!H.[ ..R!H.!..R!...!*.R!H.P ..R!Rich..R!........PE..L...u*.e.................<..........;z.......P....@..........................@......B]....@.................................`q..x..................H....1... .......]..T...................@_......P^..@............p..\............................text....:.......<.................. ..`.data........P.......@..............@....idata..P....p.......J..............@..@.rsrc...............T..............@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateBroker.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):154448
                                                                                                                                                              Entropy (8bit):6.807867336192154
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:Rf3H2h0KqYLKFBqrE0DHX7+n23LbhsMslRj53Xh6KlBrUAyDfUgQvcmsViP:d3HUqKmq5X3LbOMA53Xh7l2/ysV
                                                                                                                                                              MD5:DB30F912115EDD14D1243AD3F19DD4D9
                                                                                                                                                              SHA1:1708B6E7F8DF03D121C6415FAC9CBB2B11BF57BD
                                                                                                                                                              SHA-256:D5C7600C6A2A070A504F850CC93AD727F1247A8BDBC90D1D48205A57AC1D2115
                                                                                                                                                              SHA-512:FA7921E4F93262B50B10ED49330676D33D67F623DE2834A3538EFE96138B8008516D208421573D2F8FC80BFCD98926758730036E4C6CEE5E2C828C46A44F9F77
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.z..@)..@)..@)>{C(..@)>{E(T.@)>{D(..@).~E(..@).~D(..@).~C(..@)>{A(..@)..A)..@).~E(..@).~.)..@)...)..@).~B(..@)Rich..@)................PE..L....,.e.....................r....................@..........................`......_.....@.................................$8..<....`..............H,.../...P.......,..T...........................P-..@............................................text...s........................... ..`.rdata..b^.......`..................@..@.data........@.......&..............@....rsrc........`.......0..............@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):438608
                                                                                                                                                              Entropy (8bit):6.458531377188769
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:VMfuNoVPNlu9wHXNiOc2bbNzoonn0JG+U:VrN0FviOc2bZz70t
                                                                                                                                                              MD5:2A3AD7362E6C8808FBB4D4CCABA4ED4A
                                                                                                                                                              SHA1:3F896F7DF7FE202F4A717713C503665BB4DCAED6
                                                                                                                                                              SHA-256:4DCD341907880C8DEA840819628B19C5EA42CA2B5C61AD57147D0AC7DA9B6759
                                                                                                                                                              SHA-512:892042AC713E4D5B488262A584355DAFA18D967035788799C1773EB39A4616461BEB9D79A230D9F85CDEFD1B4076B8A5E1D4BDE17254BFF1F08C3EBA56469679
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5..PTg.PTg.PTg.$d.[Tg.$b..Tg..!c.BTg..!d.ZTg..!b..Tg..!n.kTg.$c.ETg.$f.MTg.PTf..Ug..!b.QTg..!..QTg..!e.QTg.RichPTg.................PE..d....-.e.........."............................@....................................b&....`..................................................................p..t4..Hx...9......d...P...T.......................(.......8............................................text.............................. ..`.rdata..x{.......|..................@..@.data... 8...0......................@....pdata..t4...p...6..................@..@_RDATA...............d..............@..@.rsrc................f..............@..@.reloc..d............j..............@..B................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateCore.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):525304
                                                                                                                                                              Entropy (8bit):6.843863784629847
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:8Qjngc7LQE78QMC8W5cSTskaw3YfhnsgqX:8Qjnn78ScSThaw3Yf9KX
                                                                                                                                                              MD5:DD5DC945CD848BF503862D0A68C3EA5D
                                                                                                                                                              SHA1:9B277A0C733ED5698B0656DA8C3B99D2F90C7EF8
                                                                                                                                                              SHA-256:8CC98345E367B083F545ACE66D93BF69E03A4FA08B84805A9925FA4C94EF3F8F
                                                                                                                                                              SHA-512:F6EAB8422BDE24D89A7723C6175B4197A50E18AA0BB5B8F419E5A23B265D85DCAACAF136B8F6EF6BBF2BD6C0EAECD8F86093F594FB98E596F4B39E9C6FF227E1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U...4.P.4.P.4.P.D.Q.4.P.D.Q84.P.hjP.4.P.A.Q.4.P.A.Q.4.P.A.Q.4.P.D.Q.4.P.D.Q.4.P.D.Q.4.P.D.Q.4.P.4.P.6.P.A.Q.5.P.AhP.4.P.A.Q.4.PRich.4.P........PE..L......e.....................f......0t............@..........................0............@.........................................................H....;.......A..@v..T....................w.......v..@...............8............................text...*........................... ..`.rdata..............................@..@.data...$G..........................@....rsrc...............................@..@.reloc...A.......B..................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateHelper.msi

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: AVG Update Helper, Author: AVG Technologies, Keywords: Installer, Comments: (C) 2017-2024 Gen Digital Inc., Template: Intel;1033, Revision Number: {A87CFB5C-61CB-4FE0-9552-F287D1928D95}, Create Time/Date: Thu Mar 21 12:47:58 2024, Last Saved Time/Date: Thu Mar 21 12:47:58 2024, Number of Pages: 300, Number of Words: 0, Name of Creating Application: Windows Installer XML Toolset (3.11.1.2318), Security: 2
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):32768
                                                                                                                                                              Entropy (8bit):3.7109485435414107
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:jPeAyDBOS10ey3M5ICNsSmAoQx5Pey3M5IC0ioXh:peBOS+eWMmCNseeWMmCE
                                                                                                                                                              MD5:66140E921FFC869E5DBD7D0337503F1A
                                                                                                                                                              SHA1:CC26B0818DBB2A4D3E242FD1CAF7B45E036961C0
                                                                                                                                                              SHA-256:D2EF84B42A4358E58F5566D842C389B229BA073FCEF20B2A3007B6CE76A06D2B
                                                                                                                                                              SHA-512:EB4A787E76A6700112349B5EBA78A4467BA4A2364D30EADE70ACBA480E4DF1C5D48BCB31CA136F81B350C466911AF97CB1DA1BA964C2D35003A4E3E86C738772
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateOnDemand.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):154448
                                                                                                                                                              Entropy (8bit):6.808581934006418
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:rnM/2hkKqELSFBqr00nHu9eF23TbhsMslRj53Xh6KlBrUAyDfUgQ/DgM/h:LM/0q2eqG3TbOMA53Xh7l2/fM/
                                                                                                                                                              MD5:772D18249265097851DEE4129C277653
                                                                                                                                                              SHA1:E55CCC571E5180A3D5F395D4D00974CB70493E5B
                                                                                                                                                              SHA-256:2496F8D3C663D72B547C16371DEA14CAE69EE6CBC90F8CA94BA942D095FE897A
                                                                                                                                                              SHA-512:DB423FE798ACAA10D367B5836D5A33D4B522C7B0391C8FC38B5EB1810F5C66C8038A85CB7716652D0D9243688B4D593A6F968B947ED666B3DB32892304F47FBF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.z..@)..@)..@)>{C(..@)>{E(T.@)>{D(..@).~E(..@).~D(..@).~C(..@)>{A(..@)..A)..@).~E(..@).~.)..@)...)..@).~B(..@)Rich..@)................PE..L....,.e.....................r....................@..........................`............@.................................$8..<....`..............H,.../...P.......-..T...........................`-..@............................................text...s........................... ..`.rdata..b^.......`..................@..@.data........@.......&..............@....rsrc........`.......0..............@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateSetup.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1688480
                                                                                                                                                              Entropy (8bit):7.938697411754708
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:49152:RbGTBlB4+Nlt3xF+KJh3dnd5OZ/H84G0W/4qer:BG1jhv+c1dnd5OZk4RW/
                                                                                                                                                              MD5:9750EA6C750629D2CA971AB1C074DC9D
                                                                                                                                                              SHA1:7DF3D1615BEC8F5DA86A548F45F139739BDE286B
                                                                                                                                                              SHA-256:CD1C5C7635D7E4E56287F87588DEA791CF52B8D49AE599B60EFB1B4C3567BC9C
                                                                                                                                                              SHA-512:2ECBE819085BB9903A1A1FB6C796AD3B51617DD1FD03234C86E7D830B32A11FBCBFF6CDC0191180D368497DE2102319B0F56BFD5D8AC06D4F96585164801A04B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......].T...:...:...:...9...:...?...:...>...:.K.>...:.K.9...:.K.?.).:.A.3...:...;...:...;.n.:.A....:......:.A.8...:.Rich..:.................PE..L...p*.e.................n...........R............@.................................+/....@.....................................x.... ...[..........H`..Xc..............T...........................0...@............................................text....m.......n.................. ..`.rdata..Fr.......t...r..............@..@.data...............................@....rsrc....[... ...\..................@..@.reloc...............L..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateWebPlugin.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):154448
                                                                                                                                                              Entropy (8bit):6.808400148672981
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:kHX/2iBVBAbX4pbbrWBAXJsl+B2wnbhsMslRj53Xh6KlBrUAyDfUgQIBTP3Fv:eX/LAb+btirwnbOMA53Xh7l2/hTP3
                                                                                                                                                              MD5:4263BCB0124FAEDC84CB07B46CBEAC0A
                                                                                                                                                              SHA1:B93A75DBAC32E10D474A2D05A660C4FF2FFF725F
                                                                                                                                                              SHA-256:8BBE2F03F0740CFF0417BA798A632526C7F2F397B8C1907BAA386BB96B7847EA
                                                                                                                                                              SHA-512:2F811022E55DD6E6F797EB2ACF77B315CADF34D7AB1670CFADCC993BB1EC081BBB908291CBAF901B2044A146ED2DB58546A955761236644B9C5AAB0490B20DB0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.z..@)..@)..@)>{C(..@)>{E(T.@)>{D(..@).~E(..@).~D(..@).~C(..@)>{A(..@)..A)..@).~E(..@).~.)..@)...)..@).~B(..@)Rich..@)................PE..L......e.....................r....................@..........................`.......V....@.................................$8..<....`..............H,.../...P.......,..T...........................P-..@............................................text............................... ..`.rdata..b^.......`..................@..@.data........@.......&..............@....rsrc........`.......0..............@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\acuapi.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):561472
                                                                                                                                                              Entropy (8bit):6.894656357233734
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:NfJq+D0CU+l6jkqRmZivOzqA+0gF7IZDphezIhSMXlL5hrDqOO87:zD0uZivOzqApA7IZ1hezIhSMXldFNO8
                                                                                                                                                              MD5:3C43E274193213B6B955AFEFB645F007
                                                                                                                                                              SHA1:EBB2703E2626F2DDE67C111342C47B20BBC275FA
                                                                                                                                                              SHA-256:C1365762EED2B4950B8702D0508BF84CAF2980F9C06840D82C4E8F9E5E83D8F3
                                                                                                                                                              SHA-512:134C8E745CD0604FA8489B924DDDA5229656427084981437FEA5A3E96EFE0D75B898BBF8EBA3BD27867500CB884A39ACA8779AB1C62C0C95F69F0A6FB7A69B30
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n..*...*...*...r.../.......%.............=...x...%...x...?...x...g.......-...*.....r...(...r...+...r...+...r...+...Rich*...........................PE..L......e...........!.........p......................................................Gr....@.............................l...|...(....@..p...........HT...<...P...8......T...................@.......h...@............................................text............................... ..`.rdata..............................@..@.data....-....... ..................@....rsrc...p....@......................@..@.reloc...8...P...:..................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\acuapi_64.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):719072
                                                                                                                                                              Entropy (8bit):6.675163105242217
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:LPaBHtQ7iF5W+cVU/5vJ8XVoA9MUUtEnWe7ZNgI8Qz//pLk0xTxcJzPz/s2p/Z+7:LPaH2V25vq+vRG0e3hezIhSMXlxM
                                                                                                                                                              MD5:B1624894C7A3B09042B2DBE0FA040663
                                                                                                                                                              SHA1:0466D959D3263F801925058543E16C864FD95C07
                                                                                                                                                              SHA-256:12D68A3F503E82AA68AE0CA60C3ED2AB5006987D89BBD9B63BC149C6E359CF18
                                                                                                                                                              SHA-512:A5E5A8882A94ED5FBD4A4787D8580975A6EC17F76B7044B138A178598DA9248F92F8D137C0A1FF6A81329215C9300C63DFB7C8452ADB386CD537A6B4FFC4407F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3.b2w..aw..aw..a/..`r..a...`{..a...`...a...`c..a%..`y..a%..`}..a%..`8..a...`p..aw..a...a/..`u..a/..`v..a/..av..a/..`v..aRichw..a................PE..d...+..e.........." ......................................................................`.........................................@A..p....A..(.......x........A..H....B......$...x...T.......................(......8............................................text............................... ..`.rdata...}.......~..................@..@.data....?...P...&...8..............@....pdata...A.......B...^..............@..@_RDATA..............................@..@.rsrc...x...........................@..@.reloc..$...........................@..B........................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdate.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1476176
                                                                                                                                                              Entropy (8bit):6.739577754693322
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24576:TuRNP0rZTrG+t3k1nRjaun62tjPABpIlYsgYfKf00KFq5VmfvwwTZGuTAfuzV:OP0tP3kVMunHtjP5Ss3QKFumfvwwTYuv
                                                                                                                                                              MD5:04A6438C50564146E880C5EB9D57905E
                                                                                                                                                              SHA1:EDF5D454DE99159D832CC9BD0D8DBE132D749804
                                                                                                                                                              SHA-256:26109D47BF9960E531888E6C545CA8CFC24FEE2202B549DF29FB8BF9C58E0812
                                                                                                                                                              SHA-512:8705D0AB2F8A6C1EF567AD00B33FF2CCA01391B105EB0ADE201D981F091E4BA87E709860AB9849BF9781698FB42AB8EFE53EA731AF310781766BACE1EB1DC19D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........n%.B.KMB.KMB.KM..LLC.KM..ML@.KM..HLP.KM..NL..KMsS.M@.KM.zOLS.KM.zHLZ.KM.zNL..KM..OLc.KM..JLi.KMB.JM/.KM.zBLr.KM.zKLC.KM.z.MC.KMB..My.KM.zILC.KMRichB.KM........PE..L...<,.e...........!.........d......oG..............................................R.....@.............................T............@..0s..........H*...\..........d...T...............................@............................................text............................... ..`.rdata..............................@..@.data....[....... ..................@....rsrc...0s...@...t..................@..@.reloc...............^..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_am.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):44016
                                                                                                                                                              Entropy (8bit):4.850730859886352
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FrIC84k4+R2B1KAIYiifNlBAM+o/8E9VF0NyB:Fv8ZJ8KYiiVAMxkE
                                                                                                                                                              MD5:BA03B29D5D44341084EB06BEA8F1E702
                                                                                                                                                              SHA1:7D8DD7556EA5E299B55DDC7477CA758FE2C64F48
                                                                                                                                                              SHA-256:6A6AAD33E2910C29A6D919AAD074D89359C5E6723CED7BA4E215A62E9513749B
                                                                                                                                                              SHA-512:29F902587B7078DEB12BEE6BF9993748109749EC12E6490D5F84BC9C532A5A1F414149D5760641EF052611BF2D441423D115DFB5A4C4C6F5E6D6A1F386924CF2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L......e...........!.........z............... .......................................L....@.............................D....0..(....@...p..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....p...@...r..................@..@.reloc.. ............~..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ar.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):42960
                                                                                                                                                              Entropy (8bit):4.833178144350414
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FfobWdkCAu+JGRF9IYiifFWAM+o/8E9VF0Ny1Hi7:FuWdkCAd9YiiIAMxkEm
                                                                                                                                                              MD5:9C77BE0843F0FE4864A04F8D5F24A593
                                                                                                                                                              SHA1:BE03ADB4D3C33520E652C7A6EE45F09D5FF54A54
                                                                                                                                                              SHA-256:39547FA5D7B93856235288B1021699B4F36F0BEA10B10D6B89EA184A3AD77BB1
                                                                                                                                                              SHA-512:F504C98B03A5D72C078B38A2CC4FDD94DBED159F5A2ED47C2C4A53FC6EC8A3B1FD969D5AD85FC7503E64427A36ADEE7A14F15F1275A9194103E43C8A8EE45D28
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L......e...........!.........v............... ......................................`.....@.............................D....0..(....@..Hm..........H|...+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Hm...@...n..................@..@.reloc.. ............z..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_bg.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46064
                                                                                                                                                              Entropy (8bit):4.868686647522131
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:Fg+LXdckieGZBOcIDDN9IYiifjyKmAM+o/8E9VF0NyQe:FfXVEDXYii6AMxkE/
                                                                                                                                                              MD5:C0B41217FC33A6A53EC69AE7399460F2
                                                                                                                                                              SHA1:D7DD8D543B7297F1A1E138EFA1806972C9489C3F
                                                                                                                                                              SHA-256:D75A1A41AD7E5277576E3BDF35A858BE3A6F540D21C8AB4156C842D8F1B3295B
                                                                                                                                                              SHA-512:37ABB726B78421AACCDBC94B358CDA6B581E89AC519258EB39C6A7F0706CFC64C3A96F5C29539BA67C6E2D2AFD6F10B6B0C063B54366C03376CE234D132A8253
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L......e...........!......................... ......................................&_....@.............................D....0..(....@...x..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....x...@...z..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_bn.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46064
                                                                                                                                                              Entropy (8bit):4.934496971225395
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FbmKgvUx7tYF7qWF0FrHF6rjbmBwT1nUrIYiifb5cAM+o/8E9VF0Ny1oS:F1grBF0FrFnBwhUUYiimAMxkE4
                                                                                                                                                              MD5:AEDF6D96CCB64F488379BB1FE65F697A
                                                                                                                                                              SHA1:901BBB7873D8F698F49C4B6BE74FB50B353D7B5E
                                                                                                                                                              SHA-256:941D22186EF1BFE27052E78D21944D6088CEA152D1EDE51452F04FB032C92F90
                                                                                                                                                              SHA-512:D1D889A1FE75924F3569E07D9EE3F552AFC02165210F5C439D4697BE898B72DB397BB89E7D0706259F92C1CB5759009F9E1BA5C52F764E63514B3DA41DADA1CC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L......e...........!......................... ......................................7.....@.............................D....0..(....@...y..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....y...@...z..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ca.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46064
                                                                                                                                                              Entropy (8bit):4.658137928117167
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FgxEC02ArzVuJG4bPyqoIYiifpyKAM+o/8E9VF0NyI5:F602ArBuh/YiikKAMxkEY
                                                                                                                                                              MD5:F951CF3CA93E5AE5FC1CE2DA93121D98
                                                                                                                                                              SHA1:15BC869406857437BABE41CD3F500C356913499B
                                                                                                                                                              SHA-256:EB00CAD19ED1D16F52928962F2CC6231D65EB74B2314976EBEB1EC860103E746
                                                                                                                                                              SHA-512:B77086AD2B39723D697D7839D9243C1C0769A2CB0F6287CD3F2D64EABD6A48D8FC2D253E9089C6586637ED5DC5970C2608615FE77CEF5003F0C4D53401EF73BC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L..../.e...........!......................... .......................................N....@.............................D....0..(....@..(y..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...(y...@...z..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_cs.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45040
                                                                                                                                                              Entropy (8bit):4.699208339439057
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FSWtuBWpKJkbYAA+fJ1dcIYiifHB1nIAM+o/8E9VF0NyVExg:FH/b7YiivPnIAMxkE2
                                                                                                                                                              MD5:7F3DCD851645D3D75F636C8440FB057F
                                                                                                                                                              SHA1:85DEBE41DDCB46555A0D00795E41E460A35583C2
                                                                                                                                                              SHA-256:0B31785D1931580CAD5EF16D4FF5723802D12C38B56746E70FCF91D71162E043
                                                                                                                                                              SHA-512:D0D21C397899AAA6A718B77195A6AF1556309615616FD6583ECB84B04AA7087E76EB5FDD6CAE0A4FF1C0F85BF72E1F51AE002042078095F640EB95DA363889E4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L..../.e...........!.........~............... .......................................7....@.............................D....0..(....@...t..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....t...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_da.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45040
                                                                                                                                                              Entropy (8bit):4.655648919342282
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:Fx9zRfNnwtpY6PFuC/rIYiifLPhjAM+o/8E9VF0Ny6:FLTnwkOLUYiijpjAMxkE
                                                                                                                                                              MD5:9A421423686559027E4301D36BCF58B2
                                                                                                                                                              SHA1:9669424F4E7C765DDB917A515D5A8B1486F87DAF
                                                                                                                                                              SHA-256:9D8FF148793D99974FAB93F38027E1999323A48620B303F82170751BE5DD6B69
                                                                                                                                                              SHA-512:F5D62FE17A820323C4B1832CD3BD9C8FA291D44DCEB88A8A1A8F94C6166E550AB9BAF9357C5EC3388230BC75F0CCD3AA2D5247FA5D242013D22C61001128A951
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...&/.e...........!.........~............... ......................................O.....@.............................D....0..(....@..@u..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...@u...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_de.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):47088
                                                                                                                                                              Entropy (8bit):4.6512246006331335
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FmIxYUj8gtdF0Me39ACYadIYiifgoZAM+o/8E9VF0NyO:F9neMe39ATlYiiJAMxkE
                                                                                                                                                              MD5:1C15851D9DD22E4AE3F3BF249DA79035
                                                                                                                                                              SHA1:60FC5652B5E1C55056C961D4D3B961492CB3432B
                                                                                                                                                              SHA-256:A9DD72A08C0C58A71B2289D76EFAE681A5C8EB5FAF73E49B873F15BA4050BAA6
                                                                                                                                                              SHA-512:6DA386C35B317F39613DA73340631F927606BCCD0A8C626537EDA896EB32C9A2ED1D71C7CF838F1A4B90553F3F788EEB5E02FE84774FB0AD2F574BF4E4D7E248
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...7/.e...........!......................... .......................................w....@.............................D....0..(....@...|..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....|...@...~..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_el.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46576
                                                                                                                                                              Entropy (8bit):4.945135602641649
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FUJKFEDleILkSIrGCSqlIxRFiAhAu8zBdfsBsTbCBRIYiifjeQMVQAM+o/8E9VFj:FPOZlLO+R5U/RYiiaHyAMxkEi
                                                                                                                                                              MD5:0D15748F01DF49DAE986F1E27DC098EF
                                                                                                                                                              SHA1:35A435BDAAF47795977B28CDAE2E4EA1FDAE73A3
                                                                                                                                                              SHA-256:DF13C38061CB0B02DD8A9023A17DA0BBE1CDA6FDEDAD5203129FC702C7FDD9B1
                                                                                                                                                              SHA-512:290E9936F50E3BD11C1B9D28DECF3B43F5E23BBFF16801E7B0491690773D057B6BCDCF48C48A7EE16FA2400723B3E974E2B74E3899590A8E660C2E9C78B9D141
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...E/.e...........!......................... ......................................8w....@.............................D....0..(....@..x{..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...x{...@...|..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_en-GB.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):44528
                                                                                                                                                              Entropy (8bit):4.641074368533252
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FzGT0agyh6Qu65PmiIYiifK91lwWaAM+o/8E9VF0NyR:Fg0agyhi9YiiewAMxkE
                                                                                                                                                              MD5:02465169CD873C4492196E03457F2771
                                                                                                                                                              SHA1:837CA5E54A8C12577D0D05A32996DFC04067C5EA
                                                                                                                                                              SHA-256:4EB9EDF550BF1F66382E5D8BD4958438891CD2CA46557D14F4B945DC176EC025
                                                                                                                                                              SHA-512:E73B5F3951050F2903B80B89D2B9FD9EBF69ADB922EB8238EF4C01F413AE67727D7598D4AC15F7AC8B9257AEF0139E0924C70C5898357142A303D7E2B15394C3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...`/.e...........!.........|............... ............................................@.............................G....0..(....@...r..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....r...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_en.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):44016
                                                                                                                                                              Entropy (8bit):4.656047937354881
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FwGSdagyWmpR/95IYiifd3xZAM+o/8E9VF0NyV1Fl:FGdagyWqYYiipnAMxkEB
                                                                                                                                                              MD5:418853FE486D8C021D0CCA2E85A63D63
                                                                                                                                                              SHA1:9504500A7B5076579D74C23294DF4BDB1B7C517D
                                                                                                                                                              SHA-256:4CBB2591C1EEDA32BCF295685C993CE4D16ACC968697FA12E2A00A1B7C4B37A3
                                                                                                                                                              SHA-512:DC2AB4E2056E6D73A274D700BC16F75C7C687B35874029C1908B183428DEC010373045D4A52EB3F5745F8B91D624CF5D40CD7F37E353F3A41348E2A054A266A3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...Q/.e...........!.........z............... ......................................)O....@.............................D....0..(....@...q..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....q...@...r..................@..@.reloc.. ............~..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_es-419.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45552
                                                                                                                                                              Entropy (8bit):4.648374531404977
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FlPhgKHfN4p1WY+IYiiftrb+AM+o/8E9VF0Nyy:FTgKHfN477YiixaAMxkE
                                                                                                                                                              MD5:3E5971E8559C77E8901CE30D14034730
                                                                                                                                                              SHA1:04CC21AC4A84ABD29F7D7585282345881FD81721
                                                                                                                                                              SHA-256:613418B8779F7440B88F1734D6C514706DF9DC9A58A623966CC1C9BA4E29C28F
                                                                                                                                                              SHA-512:B4592B25CF676DB6D6DE1BE811C39BDEECC24BBFD4DC72FA4B3F97DE866F9B0FEC7C85F7D56F048F61829C1D8B4109E4A0C7E14A9E410E30A6A8DA702941E00E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...z/.e...........!......................... .......................................X....@.............................H....0..(....@...v..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....v...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_es.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):47088
                                                                                                                                                              Entropy (8bit):4.635331722364897
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FcbK5mFNz51BYn2IYiifI4urAM+o/8E9VF0NyXM:F/mFNN1AYii7urAMxkE
                                                                                                                                                              MD5:5F8EA18786D5EF1927CD95537ABC3AE0
                                                                                                                                                              SHA1:5530650ECC719D83B7AA89E0B326B5698E8ADDA2
                                                                                                                                                              SHA-256:FA416294B078226A8919DBB8F75533A6EF96D63D5BD17AAC854EAE68791433CF
                                                                                                                                                              SHA-512:577DC7D19E4443E8AEDE759A781826C091C17D12FB06E89B1306133F21E01DAB919045183A916E1B5647DDF485134A8459745A9199DF5C7E36ABE192645D8E25
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...m/.e...........!......................... .......................................3....@.............................D....0..(....@..h|..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...h|...@...~..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_et.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):44528
                                                                                                                                                              Entropy (8bit):4.646586692890864
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:F1JQrrbDFbDZETJXTSQW1o5IYiifuPMAM+o/8E9VF0Ny3Qjsa:FMf96dHqLYiitAMxkEwP
                                                                                                                                                              MD5:5029406D9202D6F2F279FDD3A06F55A1
                                                                                                                                                              SHA1:DCCA8BF9392FAA0038C6CB5D25929726B16804AF
                                                                                                                                                              SHA-256:CAC545E04D701C39F4A730AEC4C3DAD177D8EA4BACA10651F150925644874864
                                                                                                                                                              SHA-512:519538E05F8E21966E4878291692CF25057BBA3C993C0034A33B1DA7C9EB0A8FB881565717CEB6C1139FD601B73B1F1E2AA46E20AEB6B93F897CD2EF93172934
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L..../.e...........!.........|............... .......................................:....@.............................D....0..(....@..xr..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...xr...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_fa.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):44016
                                                                                                                                                              Entropy (8bit):4.842490710779511
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FhWHNZNIY531DQIYiif/qoAM+o/8E9VF0NyB:FqHFVYiivAMxkE
                                                                                                                                                              MD5:8564514501256FF045CF7AA6C1B5A797
                                                                                                                                                              SHA1:40B9AA8D04C48FE2ECF193C2089418CCC938676D
                                                                                                                                                              SHA-256:F3F46A6DA6C8CCB3CE7FDD0CB5882F45523DECCA95852B8C775BB90F8E92C1B3
                                                                                                                                                              SHA-512:701077C8A1C70C1BD0C35F54AA838DBA7B7B6F832E0EF2776673092FCA546276166C3638676451C9655086B740B9E193CD54F952FD5FCA481B964083B881BCC2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L..../.e...........!.........z............... ......................................y.....@.............................D....0..(....@...p..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....p...@...r..................@..@.reloc.. ............~..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_fi.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45040
                                                                                                                                                              Entropy (8bit):4.660116656094835
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FinpDGfEzPhXY7R799hKh1GA81IUzNIYiif26AM+o/8E9VF0NyeW:FgGfEVmNgEIUOYiijAMxkEL
                                                                                                                                                              MD5:57DAD7C22BD635A5AF8FCDCD63D4E530
                                                                                                                                                              SHA1:8AA11EA5C1CACD9B23C29989F22E82C43C827D0E
                                                                                                                                                              SHA-256:1E0D05927A455115265DB9308E0F78FFB7BBB5442F36B8483549EFBE415454A2
                                                                                                                                                              SHA-512:4236609E37EC41BF46D0F45E228C9021C1624E2F98A642EAB513D290A4482DA13764FCC2D044F78EBDC09E0CFC63A251678D169CB33E251D6F6D5DE9B96C31B6
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L..../.e...........!.........~............... ......................................L.....@.............................D....0..(....@...u..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_fil.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46064
                                                                                                                                                              Entropy (8bit):4.643366949275377
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:Fe7+SUNPli+B3RVaw7yzmDqEKIYiifAnAOGAM+o/8E9VF0Nycd:FLSU9li+B3RVawWwRYiijOGAMxkEM
                                                                                                                                                              MD5:5ED0105F4043466A99557DDE1F70E97F
                                                                                                                                                              SHA1:C57C935CC4B25B6375AB3FCDFBB265F4C586EC3E
                                                                                                                                                              SHA-256:CFBE0120DDF8D5574F7C44C85488F53AECEC4DF9BFB25F1CEFBABCAD5AF46096
                                                                                                                                                              SHA-512:4FA641810F758E0031388EC146467FC130780E2F2CC8495B6A2FFF0679D7BCBE7526356F85A97B5338E84D791BA14E812B2C182FDAE01763640BE3324FB59526
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L..../.e...........!......................... .......................................d....@.............................E....0..(....@...x..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....x...@...z..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_fr.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46576
                                                                                                                                                              Entropy (8bit):4.662391785374034
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FaBMC98EoIcpW4x4QNIYiif57kAM+o/8E9VF0Nyjz0:FPCaIcNMYiieAMxkE1
                                                                                                                                                              MD5:8DDC3F7276C12AC407CADCDA6E2A3E12
                                                                                                                                                              SHA1:78C5E802F67C8B6AE3FE13202E6A54D3CCA69DF4
                                                                                                                                                              SHA-256:7F2F0F9F443A022F5AEDACC40C28D0654FEC488F34435C75979118464256A8B7
                                                                                                                                                              SHA-512:0D05BDD2D5E9F36EB09182E8B13507BA03E256C4AADB77BBFEDF29584A47FD1E0733A825A3F687D3058E53C8075CAF6DD9D24EC93F1BDD58CA97106827323540
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L..../.e...........!......................... ............................................@.............................D....0..(....@..x{..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...x{...@...|..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_gu.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46576
                                                                                                                                                              Entropy (8bit):4.921652037395085
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:F7Dwh3UreAV4DzYCQ+fwmkIc1r2GIYiifpiFAM+o/8E9VF0NyzEy:FwhUre7VbkSbYiiIAMxkEm
                                                                                                                                                              MD5:A4061E8408CC59CB898ADFDC4F173278
                                                                                                                                                              SHA1:AE34E3058A40449481590BB3A63AA0225B4F6F98
                                                                                                                                                              SHA-256:E033C950ECC6333DFCB944E70622E77A6498BA0E23FD144117DBE9A2A0C15BE6
                                                                                                                                                              SHA-512:D8A847E9A21C86C7B9B072E16914F42185E3C0E1D99F6EA5259382EB0FB89578C7A7F9F62F892F1D20BE180DFC327BC076EA038057895C8B92CB1F0C053E0B2A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L..../.e...........!......................... ......................................".....@.............................D....0..(....@..0z..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...0z...@...|..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_hi.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45040
                                                                                                                                                              Entropy (8bit):4.88079299762203
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:FkmZ6AN6Aaqxzxm8qRXtpqCpTyYiiyAMxkE:FkmUXpW71x
                                                                                                                                                              MD5:38525B8A1B15A8AEB4FCFC8BEE8358BC
                                                                                                                                                              SHA1:AC2BA33B8AD778A8165C87B579DAD0DBEF5BED75
                                                                                                                                                              SHA-256:271E83BC86E490CD5B6CB9CB34057C7684D233C56A53F4F553AA07507C9DAE52
                                                                                                                                                              SHA-512:AD8DF196174CEEADCE4588DCD365066665267B922078D92B328BA661A4EBFA6D06B4263A4B8A28E4EFB4D86E1140D71A3C3BF4B7B60970AA20552AA7F0C73ACB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L..../.e...........!.........~............... ...........................................@.............................D....0..(....@...t..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....t...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_hr.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45552
                                                                                                                                                              Entropy (8bit):4.665910901316835
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:Fzmx1myNOXz19zzMH5KBL/r1tvmIYiif+0YAM+o/8E9VF0Nyr:FE1ma5oL/JpYiitYAMxkE
                                                                                                                                                              MD5:27C0DBD61A71420BB4D1A0BE2373A175
                                                                                                                                                              SHA1:47B4C107B711CAF5A6B2978BD6FD6B53EBDEC5E3
                                                                                                                                                              SHA-256:43191A4C507A112E96E06F959B6CF78406BF970B021AD8D7DB59D1B9C52779BD
                                                                                                                                                              SHA-512:D1F20E9A628BDCBD26B8D5DE89B87BDBC8DAB871651C86D47C023DAEA86C7ADA0A565FDD05B48C7643A63DB044639F4EB89D1640E58C9B32722E4926C3C5E72A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L..../.e...........!......................... ......................................'e....@.............................D....0..(....@...v..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....v...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_hu.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45552
                                                                                                                                                              Entropy (8bit):4.688826899096205
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:FsS7U7RPX1C2TycfBwGFTbeSTZ46931lBVZpjqAy3FGVs4yYiir/AMxkEb:FsS7U791C2TzpwGFTbNZ46d1lBVZ5qAJ
                                                                                                                                                              MD5:114CC594FAB2E564CCB24A826F3623E4
                                                                                                                                                              SHA1:C3C3FB4EF6EA6FF0E7A1E0289320B2FD2788B03B
                                                                                                                                                              SHA-256:C89E223A42D7173F915DD088EBC84B0048CEC772BD4221B4B90CE4C0E419FFE6
                                                                                                                                                              SHA-512:9A7EB5710340CECB2D32DE26322DC862812E185B6D260D76C0C7F642F30CF9E43C88AEC76B515148EF986DB0C77FD0E31F71C8FD26D56A4CC72DFF0D023ABB5D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L..../.e...........!......................... .......................................:....@.............................D....0..(....@...w..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....w...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_id.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):44528
                                                                                                                                                              Entropy (8bit):4.6434847290831796
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FaVkiL3THRxVkAHqIaHQRf2I95yrUZ2XIYiifkg4AM+o/8E9VF0Ny7:F76fqgpYii14AMxkE
                                                                                                                                                              MD5:7E7DEEF6AC35C9D52410FC356391C7E4
                                                                                                                                                              SHA1:43B3D918867A93BA109A3E4EACB45F3CD5C40B93
                                                                                                                                                              SHA-256:963F4D2AD7DDCDCFB6185521C0590A92F2014897D5F5F525471AC81F3807FC5E
                                                                                                                                                              SHA-512:9EB0E9BE0A973693B4BD167F6C1118DD9D702B1951A90F0A3A6103E77C43EE6AFA173B79D3AB21FE94A98C320B17AB0B787CF5B6EC47D9DDE9E3E8C14B8CADC7
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L..../.e...........!.........|............... ............................................@.............................D....0..(....@...r..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....r...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_is.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45040
                                                                                                                                                              Entropy (8bit):4.660150671701988
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:FN66ibAIibkUVQF5UefV32Yii27AMxkEr:FN66ibAIibkUVurfVG7dx
                                                                                                                                                              MD5:DAE35FA037B6248876347521C5298566
                                                                                                                                                              SHA1:8358FC05A675EA56F720052FBB4B384D97B94D86
                                                                                                                                                              SHA-256:CE0652B8DFAF21B6192B66BF75E140B3D72AA545E0EDF62D9E82E9B0878AC5C5
                                                                                                                                                              SHA-512:4158B8FEF0DA76EAD12B5D6E421C5709664BA84D1DDDE44EF6BBD1023084CAD3820A37ABEA03B206635A945A2435B301234CF5BAC3C8E2861A852B2699036ADE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....0.e...........!.........~............... ......................................L.....@.............................D....0..(....@...t..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....t...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_it.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46576
                                                                                                                                                              Entropy (8bit):4.63382318455147
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FAebzeIN+sah32RdnIYiif1p6bAM+o/8E9VF0NyfDh:FzCIN+P3kaYiimbAMxkEh
                                                                                                                                                              MD5:3AE3106694098F8420B182AD5E3354AB
                                                                                                                                                              SHA1:BC9DAB621B03D4126B97C260BECD7F4525255462
                                                                                                                                                              SHA-256:59B406B29538C3C3D0F060B5FC0CCD36556F8A6278327935A5475C6B21741DC9
                                                                                                                                                              SHA-512:F3625BE57976083D642B01A41A53D6DB6CAD3BFC584A50DE3565FE10975A5D7D2CF4F8B41BCDAA5AC70F8FC4ADA113084DE07E2ED45F26401DC2D4F8F4C322A9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....0.e...........!......................... ......................................8.....@.............................D....0..(....@..Pz..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Pz...@...|..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_iw.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):42448
                                                                                                                                                              Entropy (8bit):4.853168372285248
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FwTGNv7hdVexaDyQa/f8ssIwVqIYiifNrAM+o/8E9VF0NyID:FFRNMrVEYiitAMxkE8
                                                                                                                                                              MD5:31227325C8617B308CCD268C2BE7E72A
                                                                                                                                                              SHA1:71E369F26E644E643FCD538D933E4087DD593F1F
                                                                                                                                                              SHA-256:4A98E34A528EFF04C2BAF4E9E50489086E58D2E32E1851F33674ABBE5E104C68
                                                                                                                                                              SHA-512:BA8D94DDE5B7B74A39ED54A5F3E47A558E0C1DEB632018C82423C06806071143851BB1D8C7A7BADA6F13E71734E7A29457F3741266972B777CDED41C953A9645
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...(0.e...........!.........t............... ............................................@.............................D....0..(....@..8k..........Hz...+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...8k...@...l..................@..@.reloc.. ............x..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ja.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41424
                                                                                                                                                              Entropy (8bit):4.886245004030595
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:Fdy7PEHjkgWYvNSLIYiifHAAM+o/8E9VF0NyOFg:FKPEDkgWIYiiIAMxkEk
                                                                                                                                                              MD5:0CFC5B7B3F86D6BFAEC9A0713DA74DF3
                                                                                                                                                              SHA1:81A278FDEE9EDC302FE4E7A88C9ADDB230CE6DF2
                                                                                                                                                              SHA-256:1D7FD1B6A614538530385E7A40EFC95D3B8BE75057AE03BF999AA2419D1F9F24
                                                                                                                                                              SHA-512:8B8F834CCEE41C69C581F0B80F26B0CDB536F87BEBD5A6B1F02CDF6F1AEA5CF5B29C356E82C7A8FD591BB16C0938A790AC8F90F6D27EDC95FC48A5AA3C30CBF0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...70.e...........!.........p............... ......................................q.....@.............................D....0..(....@..xf..........Hv...+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...xf...@...h..................@..@.reloc.. ............t..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_kn.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46576
                                                                                                                                                              Entropy (8bit):4.956816308571518
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FirqrE8RBST3JecIYiifA39t2AM+o/8E9VF0NyGE:FbrEwkUNYiimeAMxkEF
                                                                                                                                                              MD5:49000B4A101E635B05123F21B360B492
                                                                                                                                                              SHA1:635F697F41C0591168E0EEE10930728D9DEC5A53
                                                                                                                                                              SHA-256:A2AAB58A4397C040BFF69D45BEF4EDE6842034BF897799A9347232C4B6C9C7A5
                                                                                                                                                              SHA-512:9B62C2048E9C132089CCE7DA02EA5C95B5856F1C6E28D5581F4A0B1748E681BDD78C7D537D273A64F9D476E4EC62DA5C6021CC1CCB69F7BEE216E7BEC6DDC6E0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...F0.e...........!......................... .......................................M....@.............................D....0..(....@..P{..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...P{...@...|..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ko.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):40912
                                                                                                                                                              Entropy (8bit):4.906775411499508
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FnVErHzd4IY+N1vZsYoRHgA12MrlxB4xRkkTY1M5tkONMsIYiif/GIDdAM+o/8Ev:FarH2mAq/jv2YiiPAMxkE
                                                                                                                                                              MD5:DD2F783C0017630F9A2969957F4EB84E
                                                                                                                                                              SHA1:D42218DE12A7C1C48FB5E7D60E61E32CE0CD9AC6
                                                                                                                                                              SHA-256:07E63E0E3D23F192AC131EFC459C2D9F79A4ECDC39403D43FBFF320C4B5FA261
                                                                                                                                                              SHA-512:689F625DF8AEC45A6343249739EC094CBB1245A9DD8847FFE6BF62FD2D7042D529F77216DD22E8B33830CF21B158F0EF6EA42AF2248051C8D97205EB0229A22B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...U0.e...........!.........n............... ............................................@.............................D....0..(....@..(d..........Ht...+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...(d...@...f..................@..@.reloc.. ............r..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_lt.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):44528
                                                                                                                                                              Entropy (8bit):4.677924498339083
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FUAcI3nc9eHz0CwTF1B+jF2XI1PKLIYiifp+GAM+o/8E9VF0Nya:Fi2ckHz05TF1YjF3RYiioGAMxkE
                                                                                                                                                              MD5:38606BFB6C9BFDF74503F833EE2733E5
                                                                                                                                                              SHA1:670ABD1279F642EC7B19F663E53F2813A716331F
                                                                                                                                                              SHA-256:DF6C4228DA3BF66929D81B99CB35DF4A4389418490144630E1D9D5F422B56B38
                                                                                                                                                              SHA-512:6CC6F2FB0E5BF0241656CCE5DC7311F05B8D79633F2176F8C172A9FCFA9813E3963576363D539FA1A8A58FA6BBA138DD0BAA7562274FBE99BE5CDA60F4671747
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...d0.e...........!.........|............... ......................................'.....@.............................D....0..(....@...r..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....r...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_lv.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45552
                                                                                                                                                              Entropy (8bit):4.703638320348715
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:Fm+weS5yAxOeKdeVHAtIYiifX0AM+o/8E9VF0NyuOT:Frzgf1YiicAMxkEr
                                                                                                                                                              MD5:83C356F6310D51F8FFC1D67D580F5914
                                                                                                                                                              SHA1:F9BC318975F288FA47E8426B4C450A93B10AF45C
                                                                                                                                                              SHA-256:98E35CEA7CDDCE15191594A70F8E15FF2DD1C02BDE87225AF0331441C65BCA26
                                                                                                                                                              SHA-512:28A26CB1D88D072D7898ED27C3E9D056EFEDAA2CD9ECCF951429F41DF2C0162BE3C14E58CFB4CF50B633D759825FA815A9249E7690D2AB75F60424B30DBE0424
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...r0.e...........!......................... .......................................5....@.............................D....0..(....@...w..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....w...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ml.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):48152
                                                                                                                                                              Entropy (8bit):4.926265622213845
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FY1ZCwBLFZygd8/JLT1nqIYiiffHUxAM+o/8E9VF0Nyu5:F6CUSJLtYiiHyAMxkE
                                                                                                                                                              MD5:74E24332295807CA5AB8BE9F37DD19DC
                                                                                                                                                              SHA1:82FEEE443E0C8342EF830C182FC2A3C98F57FAF7
                                                                                                                                                              SHA-256:4675474B7CCAF45C9FCA9C4D141260F233807DDC68CF854D0900BB1F58522B67
                                                                                                                                                              SHA-512:6682D18ED66B06F07BB6B1DC227808D5C872685ED271FF4B34A57D4EC7C7FE5316B6207D1094327DB4E3166FC2288E47065CB72A275666A4B403DDE8E33379AF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....0.e...........!......................... ......................................,|....@.............................D....0..(....@..0...........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...0....@......................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_mr.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46064
                                                                                                                                                              Entropy (8bit):4.8976075699187085
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FlFabd4/7JK7bABYRbUvIYiifxspAM+o/8E9VF0NyUi:FCp4/7JK7b9TYii+AMxkEl
                                                                                                                                                              MD5:390C8645CB5E0F93054C063C5E5928F4
                                                                                                                                                              SHA1:0D17AC3976B3219750853715C06BAA34E8ED751C
                                                                                                                                                              SHA-256:98AE5DA68F38DD4E43E307543D3218D4180C09433AE72C3B661EB73591A7A589
                                                                                                                                                              SHA-512:B1BF09A5111890FA61DD944DBF0CF2804CDD96C5FEE3193A80FB15CDC6FDB455FB4E535E8AEC337CA4595623BEF29C7F6784E53E222C7A5DF400DC61965830F6
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....0.e...........!......................... ......................................2.....@.............................D....0..(....@..Hy..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Hy...@...z..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ms.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):44528
                                                                                                                                                              Entropy (8bit):4.650804344909199
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FcCT3TCrQLtUv6oNpaAYjZZ/fbMgTRlREm5IpIYiifyoAM+o/8E9VF0Nykg:Fns+f3TFzYiiHAMxkE
                                                                                                                                                              MD5:D9999C911F60A32046D1A4C559AE5DE3
                                                                                                                                                              SHA1:E84C1C32708A97A81358DD8ADB3FB40681F5A7AA
                                                                                                                                                              SHA-256:31A64FF7F0B1D8BB81E83680C3391C0DC5530C798B9322D11E62E2389933B548
                                                                                                                                                              SHA-512:EEFB62C906C85A94025D79A0DD35B634A08B457FCA57E2B97D514F1B5F0B9EA8450C9D387B4D9683C5D01D0088E03FD106B530470AA88229AB4123EDF00032AA
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....0.e...........!.........|............... ............................................@.............................D....0..(....@..hs..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...hs...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_nl.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46064
                                                                                                                                                              Entropy (8bit):4.642435256245184
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FOSZaiXd/T32w1o/sIYiifUvAM+o/8E9VF0NyrWF:FgitKoUYiiYAMxkEA
                                                                                                                                                              MD5:CCADD45844090D479F00D8707E962F35
                                                                                                                                                              SHA1:0654501881968CB2D954CB95DA6150047C49C0C7
                                                                                                                                                              SHA-256:854804CB86A3059BEC32D10F44123FF93060AAE05EAA72821148A4E2764ACE3E
                                                                                                                                                              SHA-512:098A384BAF41A11A6E50B2D22E1C1E1CB2D9F5897776AFA676B235F075C9ED3F404A92D4593C229E6EDEDAB4DA614B25E5CD0C73F3CB7E0AC02231CCE800F7A4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....0.e...........!......................... ......................................V.....@.............................D....0..(....@...x..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....x...@...z..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_no.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45040
                                                                                                                                                              Entropy (8bit):4.662201606247274
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:Fgg75JZSiyCSiypVVXAYSTv4q6K3QtCNrIYiifUjAM+o/8E9VF0NyXk:FUVVwYWv6K3QFYii6AMxkE
                                                                                                                                                              MD5:5A19716AC62F7B636D666BA166D00A3E
                                                                                                                                                              SHA1:0FA31113684F879E259F8521BE08FF87286724E4
                                                                                                                                                              SHA-256:94365146AE8320732DAD96344DCF6FA83D9EAF65CB7BF30E50613964F5A33E66
                                                                                                                                                              SHA-512:ACCFBFD86C4648FFF856FAFFFBE7317907E19261ED81CE5E6CD9E5AD59AE9ABBE677730527704A1B0BA898195DCC6A5081A136B4D95563863F05A8EB9FBAF9FC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....0.e...........!.........~............... ............................................@.............................D....0..(....@..Hu..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Hu...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_pl.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45552
                                                                                                                                                              Entropy (8bit):4.7016134614469465
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:F10/L7n7KZHCCN08Gp6o1HnIYiifPH7AM+o/8E9VF0NyT9J:FO/y3+ywoYii37AMxkEZ
                                                                                                                                                              MD5:5215164235C7DC3D72BCD0F832DDCD22
                                                                                                                                                              SHA1:BDE57F57953BF119B6767E0B56380DBF0E4CAD35
                                                                                                                                                              SHA-256:C997F4BAD6082C5D2483684B6A72D22153C502DF6575E28CC1BF02789D08547B
                                                                                                                                                              SHA-512:721423EA189D096764088FD8079988CBBCD98503AE2B82B0F485CB71BC81CB367588A9FCBDC9C5D09F20067F5EC8744572D252500AF034EDF900243E096526C3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....0.e...........!......................... ......................................6.....@.............................D....0..(....@.. w..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc... w...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_pt-BR.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45040
                                                                                                                                                              Entropy (8bit):4.66806219304549
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FkqLoZc+GZX8O1EsAIYiifXMrAM+o/8E9VF0NyuN:FLmFyXYiiwAMxkE
                                                                                                                                                              MD5:97C200CBD682C1B4BD28222437D7F630
                                                                                                                                                              SHA1:6BED6312571EA79DF6DEDA2934D328683674B059
                                                                                                                                                              SHA-256:3ADC3BD14D6A1AE14DE42EA501FA74ED651B197A7C8912B43D31FA92F500D630
                                                                                                                                                              SHA-512:8E1AF6B73729F5F6E3015C3890E8AD28ED851D1615FE0AE2B7997F3AE48958FBC90E74CE70CE4EF35AEEA35A810DE0699494D5B913F4774416ACC1AA8EF0A9D6
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....0.e...........!.........~............... ......................................M.....@.............................G....0..(....@...u..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_pt-PT.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45552
                                                                                                                                                              Entropy (8bit):4.647566471839956
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:F2eyzstFNEx6ewBf1/UBIYiifT2AM+o/8E9VF0NyKGP:F8IMx/U9vYiiiAMxkE
                                                                                                                                                              MD5:D30B159A64D1698CFC29D336B26DD922
                                                                                                                                                              SHA1:CB22D98F4F03C718B7588FE7D61469B53B3F5488
                                                                                                                                                              SHA-256:5436A04ED13F635E820C748D10EFD86B94931B689F5AC834FCF7D6081D0AAB4E
                                                                                                                                                              SHA-512:448F9B2DFF2FB48F31D5D7953B4DDF347369ADE4B08AF9C8CCB337DE5E7D14B8B49E5C436D785A3A0DF00E41289AD29E0581840AD8A00653D290EE9C121BB691
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....0.e...........!......................... ............................................@.............................G....0..(....@...v..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....v...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ro.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45552
                                                                                                                                                              Entropy (8bit):4.669510664963654
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:FxcDC1yNbMUB251BRHc871nDtCuUYiifAMxkEG:Fxc6BRHnRDVU7ax
                                                                                                                                                              MD5:9D85D4410FBC05AD19686079129BB0D4
                                                                                                                                                              SHA1:8B21633A2190AEBDA899D7902E130CF4C035DE66
                                                                                                                                                              SHA-256:B0745258F9B3EA6F011B2ED61D61312A9636D5CC8706D525D403FDAB5FF5B46A
                                                                                                                                                              SHA-512:636F997817EDC9531FEA2BF7327A78203626EE8B30B2024905F9F4F88B121A325471C2C16E691A590713A09C040CEB0F9BA9F468784C959A2318B9626B59A247
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....0.e...........!......................... ......................................).....@.............................D....0..(....@...w..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....w...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ru.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):44528
                                                                                                                                                              Entropy (8bit):4.872218382175696
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FpK6JF44vKAvHdho4d2lw1iqIYiifY3XAM+o/8E9VF0NyI:FTdvHsloIYiicAMxkE
                                                                                                                                                              MD5:5C7F5208991B9F8EC135A8BB06E805E6
                                                                                                                                                              SHA1:5AB93B5EFCAC3A7D0B6E17CC1D32521E92388D2E
                                                                                                                                                              SHA-256:776084A71292C1402B439AD1D4F0414BC196EFE453C338E42944D4BFF6816817
                                                                                                                                                              SHA-512:12F9F541BA0CAB26B414CCF8099337A6A730FB8693F1F7BC30B5254ACC2C883DCCBDAC1B4F243218DFE5C41B3059E1A3C877C0C14E872609029B071C8A1E27A0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....1.e...........!.........|............... ......................................H.....@.............................D....0..(....@..ps..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...ps...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_sk.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45040
                                                                                                                                                              Entropy (8bit):4.699382433415797
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FUqXI8uh+PiR6gLT93JOIYiifK0yiAM+o/8E9VF0Ny8:FLejRjpJYii4iAMxkE
                                                                                                                                                              MD5:C89B0C8C3B91985EA2E215667F7FE79D
                                                                                                                                                              SHA1:3D646B06B540A12E9B4E1E3C44DA70334875E0E9
                                                                                                                                                              SHA-256:6E139010616388B1794F6C5D88835AC963AE60D53A509CE54F5AA994A35CB292
                                                                                                                                                              SHA-512:C050748256998D0361FB02E5D9797B957917B20669A4308A3A3E0F54946060FF7CC39FDE71D8BF7BB2AF12058075E6156E6EEABD2050B65DC3C8E3D9217F1E25
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....1.e...........!.........~............... ......................................0a....@.............................D....0..(....@...u..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_sl.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45552
                                                                                                                                                              Entropy (8bit):4.659294505999352
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:Fmu/ITsshVyixlk5TpWBdf1i2IXousGuFAIYiifeNsAM+o/8E9VF0NyvH:Fh74lk5y1YZs1YiiNAMxkE9
                                                                                                                                                              MD5:D35230F93F12E95AD99C10D39DEC016A
                                                                                                                                                              SHA1:C303793C2EE4B9995862D7FFEBC78F966344843D
                                                                                                                                                              SHA-256:85813F97EE64C8633D3CEEFC0FA13F1DE021EB6911195C72FAB2C9B95496CDC7
                                                                                                                                                              SHA-512:78E39BDA68E28963D0C4DF8D24C0B4C56BFD2666FC02E7952916CB9F98724C3D758CAAF99AEE6E936461A9A685437327F10A543CB457E562FE70FE557665B589
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....1.e...........!......................... ............................................@.............................D....0..(....@..hv..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...hv...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_sr.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45040
                                                                                                                                                              Entropy (8bit):4.86697870674738
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FauhcB7ixHUjY13tGUyJDqIYiif+ujAM+o/8E9VF0NyH:FPc6UjudG/XYiinAMxkE
                                                                                                                                                              MD5:F8709246B0E8F490CF9D02D2CCEA3DA6
                                                                                                                                                              SHA1:3909C4AA86D47C799E5DF03556C5D39EEC254850
                                                                                                                                                              SHA-256:7CFE886DD1FBBE9F3CEA93D547E88893F30471B3866BA16357CEB29F47E8916A
                                                                                                                                                              SHA-512:1BA16AF0AA64A64AA1FBF0C487E467D1432DBD8048801590BCA9C9AE0A935F1DF952068B6AD6D10E1D02714570141DAFA5A021B50FEE6FF597F65EA03398A249
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...)1.e...........!.........~............... ............................................@.............................D....0..(....@..Pu..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Pu...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_sv.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45040
                                                                                                                                                              Entropy (8bit):4.667264057142065
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:Fb4MMxC7vc3ET1f8sIYiifwuw+AM+o/8E9VF0Nykb:F9MxCDc3Eh+YiiJPAMxkEe
                                                                                                                                                              MD5:B8D8D9B17CC97212360C25E681100F53
                                                                                                                                                              SHA1:6BC19BDFB2B3C654DD7F046D76FB40A67B852D42
                                                                                                                                                              SHA-256:F26DB77619F6971C9BC93818A4C09B1F0AC2EB8DD3750750F7A5687D3DC6821E
                                                                                                                                                              SHA-512:B409CF8540DDCDCFF78CCF80819FA6C77BEC5DFEA07C4A7FA260F6C6363B932386C0F1B5C4BDCC317FE2DF3839EB58A0E69196B2A68D70915081EBC983CFB8B7
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...61.e...........!.........~............... ............................................@.............................D....0..(....@...u..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_sw.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46576
                                                                                                                                                              Entropy (8bit):4.69554904846272
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:Fvld8gicgiY7upv4M5FwbIYiifaGEAM+o/8E9VF0NyO9:FD8Q07Gv4M5vYiidEAMxkEM
                                                                                                                                                              MD5:2BEBACB8BBCF1AB8BF0C8D99D5F023A8
                                                                                                                                                              SHA1:FA6BBA3E1302E68DB673490595C5206CCBE278BE
                                                                                                                                                              SHA-256:71B1892D0A58FDA202B93BEE5E25DA3A33091A728551870EBB09003AA0178CC9
                                                                                                                                                              SHA-512:5C7751FB54531C06B26846807E3552C150CFF737096166C627E66BEE87CF1DC0BC4E5F245E4BA26660A0D0AAD0708BCD09C7F8334504DCE35552DD62F774F441
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...B1.e...........!......................... .......................................C....@.............................D....0..(....@...z..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....z...@...|..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ta.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):47088
                                                                                                                                                              Entropy (8bit):4.945882549056105
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FUSEFwsY51ZLm+4LwXdwIYiifqFnAM+o/8E9VF0NyaX:FYFXY51ZLm+4LwnYii8nAMxkE
                                                                                                                                                              MD5:100F983BFBE3DD304E3460D0D763A5A0
                                                                                                                                                              SHA1:554A6AD7F279D88DE4BEB0D110F08EB1F6079A40
                                                                                                                                                              SHA-256:71CB104A5A65A2217046BA791AADF6D92D26FED572B8BAB426F1977DCD13EE84
                                                                                                                                                              SHA-512:46FDBED864D098654CC804819BFA193D0ECD5D1CB206AB558E3EAD53AA01A8A7A4BF30A493FE51C861EEF630D20F697C880D90DB87E54F4063EF3B8BD3782002
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...O1.e...........!......................... ............................................@.............................D....0..(....@...|..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....|...@...~..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_te.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46576
                                                                                                                                                              Entropy (8bit):4.897604155898617
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:Ft+0Dqw45Z4aJALDoGoIYiifeWUnAM+o/8E9VF0Ny4:FhDqd5yaaLDZYiiG7AMxkE
                                                                                                                                                              MD5:09F080D9B57532AD375924C8B79AA863
                                                                                                                                                              SHA1:7C3589D33CE76C61E9078A38B843C52E9ABB5098
                                                                                                                                                              SHA-256:866001CF685E35F808B626ADD94F8DC1AA6CCC3F7F93622E4F1749E8276DF8AF
                                                                                                                                                              SHA-512:F6C33D74E095C1BABD14237D61230203CBBFC1675ACEFD32B7905D563F2321C55C26CBB0CC05C6FF2EA5816D23220E510F6D5B7916FE0BA314F3C0D9AFB21779
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...\1.e...........!......................... ............................................@.............................D....0..(....@..@z..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...@z...@...|..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_th.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):44016
                                                                                                                                                              Entropy (8bit):4.900742032907252
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FBRlAlrGsMKNMAcetNF1BHrgIYiifnl6JIAM+o/8E9VF0Nyxq:FdAlrGszNMJetNXBLpYii1AMxkE
                                                                                                                                                              MD5:07DB9EC1C345BE55F5124BE7B5C2D0DA
                                                                                                                                                              SHA1:BFB3409AC023DBBA2532F57AEC2AA22097B452B9
                                                                                                                                                              SHA-256:57A70C0CCB809BB7D4AD6AC611BF99266AE50BADAF0EE12D145080E79B1BCB29
                                                                                                                                                              SHA-512:8E9C0800A70DDD2868C7866F0DA5EDDD90EA014228B92B186E97131FEAF534C1477C902995D03F40D2D7661387F007FBED6E5B88A3324D5F770F6A80BBD05D78
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...h1.e...........!.........z............... .......................................]....@.............................D....0..(....@...p..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....p...@...r..................@..@.reloc.. ............~..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_tr.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45040
                                                                                                                                                              Entropy (8bit):4.7104907521422525
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:Fy1p9ABk6qXQEdmvgh57GE+G9Ahrx++BzQSXBdYiiJUAMxkE:Fy1Zhdmva7GESxLQKBd7ayx
                                                                                                                                                              MD5:A2408056E2891786989AE7089B03F045
                                                                                                                                                              SHA1:FB65851E2D17A85CDBCF86EDEF757C1DB9734216
                                                                                                                                                              SHA-256:9E3C6F396605850CB66B09870FDB346F64BA19001FB04BF416B504A5FBD572EF
                                                                                                                                                              SHA-512:04C1136638B4F99ADC0A46760843F0BBA502D4ED3D715B42D90B3CAF0FB49CC4B878590BFDBC7FBBFB71C0EC9AABF4250C375D4977E7C722B8F283ADAF902C13
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...t1.e...........!.........~............... ......................................|h....@.............................D....0..(....@...u..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_uk.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):44528
                                                                                                                                                              Entropy (8bit):4.886178525177006
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FCNlWEKgHWyC2EeEWNXE/Gfua1ioIYiifNjAM+o/8E9VF0Nyy/:FOWElu+SYiiJAMxkE
                                                                                                                                                              MD5:F13699D054B4A5C7F7555BDF42DC2B2E
                                                                                                                                                              SHA1:899D230BF0E4DBF51B552288B7A65FAEFDEC15E1
                                                                                                                                                              SHA-256:585B4E9581E4531445A41676C87822A8F721E384A5A9DDDC17642B39BD983E7F
                                                                                                                                                              SHA-512:DEDB6E3DA8025B45D1D7A87FC9235DC156C4E5E322DEDBBF8ED8C3A4E719BD6D9232E836C7BA0D14E93FE70728195BB8213682A324B3765B868B9780269130A9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....1.e...........!.........|............... ......................................>{....@.............................D....0..(....@...s..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....s...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ur.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45040
                                                                                                                                                              Entropy (8bit):4.853180692090808
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:FhZ8Q+OmAcoWAOeesY2f2YiilJAMxkEnh:Fhp27wRxb
                                                                                                                                                              MD5:440107FFDC419C31118E13311DD07092
                                                                                                                                                              SHA1:E19CD50AA757D6806A295C18A9EF52F92E85F124
                                                                                                                                                              SHA-256:FCC94C5D16A4FB8C3BDB191E9CF1FD2B60A780C8E7C247F1B513B2DAE7A51AF9
                                                                                                                                                              SHA-512:20F150D0B4FA888202FCBE0C1249F81579A81BBF41EA2F64E44DD03A10E55B504664058CACE169C122260F9EBF30E143F75A92C54877F3B2098E84E3C699B21C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....1.e...........!.........~............... .......................................!....@.............................D....0..(....@...t..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....t...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_vi.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):44528
                                                                                                                                                              Entropy (8bit):4.7736357938320655
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FtoX9fhFjnco1m6rIYiiftYPFAM+o/8E9VF0NyT/gW:FI9fhVcw+YiiKdAMxkE
                                                                                                                                                              MD5:2390C3C4DDFA136A23575187550C7612
                                                                                                                                                              SHA1:DD539EC73E7E9C706CA2EA305CBA1F9C8B3AE257
                                                                                                                                                              SHA-256:88499F0E0D5E4F3C34C020DFA672F7F16992290CC624A4B086C1AC5357FA214B
                                                                                                                                                              SHA-512:29C327B44A1EAE93196BFB2C65F4246B7343DE00921BEEE641B53499622998C73E356D20E454DF7C2D68D5B54334E423E64A27D31B537BB5B5B315AD3C218E24
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....1.e...........!.........|............... ............................................@.............................D....0..(....@...s..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....s...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_zh-CN.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):38824
                                                                                                                                                              Entropy (8bit):4.841360671519499
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FHa/65shAFB3fcdIYiifS6AM+o/8E9VF0Ny7o:FIRAFBLYii1AMxkEK
                                                                                                                                                              MD5:30FF48252DA52C816EDE2E88B9E03D6A
                                                                                                                                                              SHA1:07D16CBEF6F0042173A783D91F5DD8FDAAD4C399
                                                                                                                                                              SHA-256:F53A4AE21D6B6D92A38D53752CB3A8375778A8F06E8E3D934C37FB3454925C52
                                                                                                                                                              SHA-512:48A50815A0E9111CF144514362C9E6E68F7E7C123270A25A5A44ED8C2AC58652A9DE0740593698E4AC55703FE94D6C14C74B52DA6757253288B8A3DB5F9F2129
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....1.e...........!.........f............... ......................................u.....@.............................G....0..(....@..X]..........Hl..`+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...X]...@...^..................@..@.reloc.. ............j..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_zh-TW.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):38824
                                                                                                                                                              Entropy (8bit):4.856840920839133
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FMozg9GmewVCIYiifF5fcAM+o/8E9VF0NyjjU:FFQzYiiMAMxkExo
                                                                                                                                                              MD5:49BC03FDD21621E636F35AC544F6E002
                                                                                                                                                              SHA1:BD55D8B28EBF714A22B57A671A838967B2B166A5
                                                                                                                                                              SHA-256:C2F447C5B563A081AEF0F73BD7835927C6A8869D2B57888D7499F0738C31459A
                                                                                                                                                              SHA-512:ADC2D172D554C0455CF81BAB3F107F3B138B5C132DF4A4951234F911F5AEAC77F7014F83A8BCB2209FE1111946AC30EE2B703D80AE6B14BEE9C5A95E248C7174
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....1.e...........!.........f............... ......................................w.....@.............................G....0..(....@...]..........Hl..`+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....]...@...^..................@..@.reloc.. ............j..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\npAvgBrowserUpdate3.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):519160
                                                                                                                                                              Entropy (8bit):6.796736322809112
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:ar+V/qwxl3kPrQ2jU9F0A3oiSdTP4iw/I:C+V/9xlwjUYVddTgiw
                                                                                                                                                              MD5:C6A2BFF8E96B5622BF6841A671F4E564
                                                                                                                                                              SHA1:FB638E9C72604CC1B160385FA803B0EA028E5D5E
                                                                                                                                                              SHA-256:7A7A12E9C0DEE713700081B9354647972A0F3505596DF34E4C68AABA99046992
                                                                                                                                                              SHA-512:22A99F860055388E34A056AF5D5E35F2E33A9294784795ACA52FD42685D75AEBB523ADD836C5E4B9B2F68FE00348D11EE56CC10208FCC662B86A6169664F934F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........iI..'...'...'..}"...'.rx ...'.rx!...'.rx$...'.rx".Z.'..T...'..}#...'..}$...'..}"...'.rx#...'.rx&...'...&...'..}....'..}'...'..}...'..}%...'.Rich..'.........................PE..L...d,.e...........!....."..........[........@............................... ............@..........................;.......<..........P...........H....;......DI...%..T....................'......(&..@............@...............................text.... .......".................. ..`.rdata.......@.......&..............@..@.data....H...`.......8..............@....rsrc...P............J..............@..@.reloc..DI.......J...f..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\psmachine.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):396224
                                                                                                                                                              Entropy (8bit):6.6361079440133315
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6144:64zNJdcJ1OBrpGdYoq+ybZ4rYICzOHz25HzPCJKwAOer0wUl4rgOdr:lNDcJ1645ybZ4rYICzChs0/0Lr
                                                                                                                                                              MD5:E105363EA90F281E16D3166A5604048C
                                                                                                                                                              SHA1:9FD0DE31161CDE1C74132B33EF1F81A9320A73FD
                                                                                                                                                              SHA-256:FA1676CD10754717FDD8B92DC5660E621CD9F9E1F056CED548723B6C5BD98355
                                                                                                                                                              SHA-512:E70DF3E9CDD01C9A16D5748296B0577A18204EE7630D855A312B6FB833847ECE2697996CF2AC5317D4D8519D84EC0C7180F760B0F38FB42F8952CD76CBA2F973
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........IB..(,T.(,T.(,T.X/U.(,T.X)U@(,T.](U.(,T.]/U.(,T.])U.(,T.X(U.(,T.X-U.(,T.(-T)),T.]%U.(,T.],U.(,T.].T.(,T.(.T.(,T.].U.(,TRich.(,T................PE..L...C..e...........!.........................................................0............@..........................3.......3...........V..........H...x7......L5......T...........................0...@............................................text............................... ..`.orpc...c........................... ..`.rdata...X.......Z..................@..@.data....4...P.......,..............@....rsrc....V.......X...F..............@..@.reloc..L5.......6..................@..B................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\psmachine_64.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):521280
                                                                                                                                                              Entropy (8bit):6.356837749790641
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:tTfHJFKFK/IMakxvvCFjE0T1oM40MEXd:tTxekoFjE0hE0M
                                                                                                                                                              MD5:0636B267BDCBC3F0DEC2A7223220A5F7
                                                                                                                                                              SHA1:5A9CCC93B7076008E3DEE777F593E7D13B566386
                                                                                                                                                              SHA-256:E1933E8EA4FA969C52ED1306FD4065B4B6F0E236F582D8C3CEE69DCD087CEE4D
                                                                                                                                                              SHA-512:509F5F54322208179DFF56B238974C3346AE962CE927C54A4326FE541444ACD0DD66E9C43D142AE4D592F5CCC4599E07DAB8E50664E044F242F0ADA8B3C359DC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-..i...i...i.....b........;..y...;..c...;..$.....q.....v...i......1..W...1..h...1.V.h...i.>.h...1..h...Richi...........................PE..d...Z..e.........." ................(........................................0......2'....`..............................................................V...`...9..H....;......(.......T.......................(... ...8............0...............................text............................... ..`.orpc...$.... ...................... ..`.rdata.......0......................@..@.data....N.......&..................@....pdata...9...`...:..................@..@_RDATA...............H..............@..@.rsrc....V.......X...J..............@..@.reloc..(...........................@..B........................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\psuser.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):396224
                                                                                                                                                              Entropy (8bit):6.635408355334313
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6144:84zNJdcJ1OBrpGdYoq+yDZ4rYICzOHz25HzPCJK+AOAr0Q8l4zgOdr:DNDcJ1645yDZ4rYICzCPC0HcLr
                                                                                                                                                              MD5:334E1A8A1AD36AFEB01CD518ACB0A169
                                                                                                                                                              SHA1:92F743D1B1AA9FE90572DFACD5C9E951C873BDB5
                                                                                                                                                              SHA-256:53EA8B812A6E95B065B81AC09AC66C2A9A92C01FBB9FF7FA80745C54E3E1084F
                                                                                                                                                              SHA-512:E192D16E6BE355687B332008348FAA58B04BA167758301F01F4AD9DA3A4B2B2B79F0833D7BC14021C818677A3516E005988AC478EBA4D5CFF27C784E01CBB373
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........IB..(,T.(,T.(,T.X/U.(,T.X)U@(,T.](U.(,T.]/U.(,T.])U.(,T.X(U.(,T.X-U.(,T.(-T)),T.]%U.(,T.],U.(,T.].T.(,T.(.T.(,T.].U.(,TRich.(,T................PE..L...o..e...........!.........................................................0.......j....@..........................3.......3...........V..........H...x7......L5......T...........................0...@............................................text............................... ..`.orpc...c........................... ..`.rdata...X.......Z..................@..@.data....4...P.......,..............@....rsrc....V.......X...F..............@..@.reloc..L5.......6..................@..B................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\psuser_64.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):521280
                                                                                                                                                              Entropy (8bit):6.35654089402388
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6144:CMI/T3wuTTHJFIogFK/IMakdbv4aU5iWM1uEn0T1ohLWMV450dWE9e0l4uJV:6TfHJFKFK/IMakxvvCFjE0T1oF80MEn
                                                                                                                                                              MD5:6FC24C326EBAC1247427537D237B4ED9
                                                                                                                                                              SHA1:597CEEF4704DD4D61AA768EAC276BE02F24DFEC9
                                                                                                                                                              SHA-256:B428F332DF0E881437C78557A646A6A3E05F69072B3BD3A6343B23A3E84EDB0F
                                                                                                                                                              SHA-512:6C28A388A71D671331E9A861CE35F98B8AA47900DA37D072E13BE786C24DC5711F5776B630A7DB22F46414FC1E347659BC610B7A8EF06F39AD99F84810854113
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-..i...i...i.....b........;..y...;..c...;..$.....q.....v...i......1..W...1..h...1.V.h...i.>.h...1..h...Richi...........................PE..d......e.........." ................(........................................0......yA....`..............................................................V...`...9..H....;......(.......T.......................(... ...8............0...............................text............................... ..`.orpc...$.... ...................... ..`.rdata.......0......................@..@.data....N.......&..................@....pdata...9...`...:..................@..@_RDATA...............H..............@..@.rsrc....V.......X...J..............@..@.reloc..(...........................@..B........................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):209736
                                                                                                                                                              Entropy (8bit):6.338157428900468
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:IjbidjsOxTePH/lqa8ggDemWSzuwJWwqjPcbhsMslRj53Xh6KlBrUAyDfUgQh7sb:Mtqa8VxJMUbOMA53Xh7l2/64U
                                                                                                                                                              MD5:CBCDF56C8A2788ED761AD3178E2D6E9C
                                                                                                                                                              SHA1:BDEE21667760BC0DF3046D6073A05D779FDC82CB
                                                                                                                                                              SHA-256:E9265A40E5EE5302E8E225EA39A67D452EAAC20370F8B2828340BA079ABBBFD3
                                                                                                                                                              SHA-512:5F68E7DFFDD3424E0EB2E5CD3D05F8B6BA497AAB9408702505341B2C89F265EBB4F9177611D51B9A56629A564431421F3ECB8B25EB08FB2C54DFEDDECB9E9F2E
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T.<r..R!..R!..R!..Q ..R!..W ..R!..V ..R!B.V ..R!B.Q ..R!B.W <.R!..S ..R!..S!s.R!H.[ ..R!H.!..R!...!*.R!H.P ..R!Rich..R!........PE..L...u*.e.................<..........;z.......P....@..........................@......B]....@.................................`q..x..................H....1... .......]..T...................@_......P^..@............p..\............................text....:.......<.................. ..`.data........P.......@..............@....idata..P....p.......J..............@..@.rsrc...............T..............@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\Download\{48F69C39-1356-4A7B-A899-70E3539D4982}\124.0.25069.209\AVGBrowserInstaller.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):117845816
                                                                                                                                                              Entropy (8bit):7.99995911243968
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1572864:Eo/Cf3EE5ttFcz+k5lSfktugC46P/Z8hTmvDcf4lUJjnOwiI5S7hnAPrd2xYa5R4:EEa3f5tzkjY4mKQm49tiZxa5O
                                                                                                                                                              MD5:371F796FCFD9D0BA16C7DA57487323A0
                                                                                                                                                              SHA1:87264EF1B5C17CC39843D4A70B8A2B36575462F8
                                                                                                                                                              SHA-256:C7B20321E1E02F65388121FF44C0F385F3165D3B6933432FE69177F8D1B288D2
                                                                                                                                                              SHA-512:DB42B34DFA253C51F386DD45AC99A5FD48A6502FDD1EFF842C406672BC1593274A348667B093E5826439A054A74E8DDABFE652FC79BE0AD5F75C6CDE1E3D7FAF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....;f.........."..........&.................@.....................................j....`.................................................xG..P............p......HZ..........$....F...............................@..8............I...............................text....-.......................... ..`.rdata.......@.......2..............@..@.data...@....`.......D..............@....pdata.......p.......F..............@..@.retplne.............J...................rsrc................L..............@..@.reloc..$............X..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\AVGBrowserInstaller.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):117845816
                                                                                                                                                              Entropy (8bit):7.99995911243968
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1572864:Eo/Cf3EE5ttFcz+k5lSfktugC46P/Z8hTmvDcf4lUJjnOwiI5S7hnAPrd2xYa5R4:EEa3f5tzkjY4mKQm49tiZxa5O
                                                                                                                                                              MD5:371F796FCFD9D0BA16C7DA57487323A0
                                                                                                                                                              SHA1:87264EF1B5C17CC39843D4A70B8A2B36575462F8
                                                                                                                                                              SHA-256:C7B20321E1E02F65388121FF44C0F385F3165D3B6933432FE69177F8D1B288D2
                                                                                                                                                              SHA-512:DB42B34DFA253C51F386DD45AC99A5FD48A6502FDD1EFF842C406672BC1593274A348667B093E5826439A054A74E8DDABFE652FC79BE0AD5F75C6CDE1E3D7FAF
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....;f.........."..........&.................@.....................................j....`.................................................xG..P............p......HZ..........$....F...............................@..8............I...............................text....-.......................... ..`.rdata.......@.......2..............@..@.data...@....`.......D..............@....pdata.......p.......F..............@..@.retplne.............J...................rsrc................L..............@..@.reloc..$............X..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\SECURE.PACKED.7Z

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\AVGBrowserInstaller.exe
                                                                                                                                                              File Type:7-zip archive data, version 0.4
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):115141403
                                                                                                                                                              Entropy (8bit):7.99999824092514
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1572864:ko/Cf3EE5ttFcz+k5lSfktugC46P/Z8hTmvDcf4lUJjnOwiI5S7hnAPrd2xYa5Rr:kEa3f5tzkjY4mKQm49tiZxa5Ou
                                                                                                                                                              MD5:A34D5EEDAFA867FBA03AFF309CA29E1A
                                                                                                                                                              SHA1:1C99CCD91C2BEB05DBCE51F51CE53F6BA8BF5E06
                                                                                                                                                              SHA-256:1F9F26AF44A7FCFF1D8C2326A39EB83900D6FDF512A5FA07394BEE708D8F2EAC
                                                                                                                                                              SHA-512:66A2F1F8AC71FC8EAFD359B8AF310E8652471D05882ED8E27A27021912D23AEE5BD263BD988D37D6AE5EED7CC44BB0D82F17246DF6A32749C66A927318CE041B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:7z..'....Ux.m...............|.........8%D......4.z...g.n:..$b...b...W.4....AM.M..g..$...m...?..c[8..Oz5MX.2...m.......@.f.......G..W.fo.%.X..|..|#...[.=o..i\o..>..D.g..O.=....|%.^..i\>Px..;n.z.L....x..*w7~.UB.z7d*+..f...iJ..`.JV(....I=.`R06.~*...:3U..E.z./...=.....V.8e.JP.h.....H......=M.......M..XWIUC..&m.l.{.J....X.)i9Kj..B....X.}..7.....A,...o.s....*..^..0...;.Tj.<...e.W...~iR..1.-..k.i.@f..-..u.u..... u..S...*U.....;..f..r.c...C...D.&iF=.i.K.81:.p.d... ....Sa........;.P.e.I..^..p.G..X.]pFB..}...RC....P.).0...SE..".S.m.k...e..&).l..~..9.}J..cKk..........x.'3...'BC<.:z..*.e.*#@%../..G..W..m..}.a!.......`.V.............f.\.j....Z....-i...g63...O..,Y..H..F<...$Yi~Ry3.g...b$..:..K..3...{8Q.H..}.G.S..(P3;Ub@.x.CK...Q.4...M`@6S..+.Y.lf$..._E.*vHbVyA...k.;7..\._...Qf.|%.*a.h....(.`.u_q...B6.7.0....j."......0.@.......k.!.+..c....?.8......P.{....ec1.(..H`.rPk.g.P......4E....-.S.....HgR.d.9.....!}}....c%?.n..}.....<MB:..P.`.b...Y.B.^r.. ..8.2.....

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\SETUP.EX_

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\AVGBrowserInstaller.exe
                                                                                                                                                              File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 1586517 bytes, 1 file, at 0x2c "setup.exe", number 1, 107 datablocks, 0x1 compression
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1586517
                                                                                                                                                              Entropy (8bit):7.99793588723517
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:49152:0D303rzSMzGt/yJy5Fj1PmgHmwEkXPB8Dd:+YrGQgF5H1P/BOd
                                                                                                                                                              MD5:8B1DAA1794D0B11793D290268D2123DE
                                                                                                                                                              SHA1:DE46DDDD04C951015EAB64EADB8AE0A4BDE0B92E
                                                                                                                                                              SHA-256:34ADD06A497FB6C9992A739BD1E1B18F54BF557D94B572F7B636F5FCF3ACFFF1
                                                                                                                                                              SHA-512:44DAA3FE6633BDECC125A914EB0E8F0683C4768392F0DEABE4755F21B2B3AE3051A41AF1FA6A4C7778827F4CD58CEAE6272B272C4C78C19EA33AAC477233E143
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MSCF....U5......,...................F...k....`5........XkA..setup.exe......,..CK.}.t..h..0`L...r .`..h.X.......[.bd..ld....Q.`.c$4..N{..8o.o...d.7.y&.9...IFB...H....X.....,,.O4..nwO.G?lg.......[U..n.....M...t.......&......yg......U..;*....=...'..mp,_.X...k.y..9...X9..q..........(3.E...[F...q..j...m.'0..N........B.x../....c.qI.g.g\.p]..U.@..*.#9.1.{.ol...Y\.O..+\............%.....7.q.6...\.qp..J...Vn.......'...q.3.xr...y.h..}N.~Z\?...q._. .Y...4...J...Y.:..q..t......|SY9.g....8`3......PY.v..`C..$#.2...o.z......gs]../8s..b...n.6l..mL.7...zm./.o.z.M...ox=y.s..V-....N|?..y.#y."..].......>.dE..e..RK6...dx3._....u.t..F..R...q.c.k.v......$.|.....Q.#P......7.v..-e|...h34.E...D.Qh<.Z.w..o/.q.\.....^{*x...gk...$...../x.b@.9.c.?(..X..q6hq....}.l...8.w....S.v..~;.l..o..$......~........'......@.dN......8..........E.~......b.J..'...X..a...N...8.N`....a.0..p?..".....L."...~x.I.l5..'.._D.`g//.#)B..h'b......X\...X..^}*..:.TL.....M......k..

                                                                                                                                                              C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\AVGBrowserInstaller.exe
                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3498000
                                                                                                                                                              Entropy (8bit):6.2994726754710735
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:49152:A4hvVprRlXYPRqLxrO4EoFuL5OvQ6SZ8m38G5Xfy70:pFyq9O+FS5O6x
                                                                                                                                                              MD5:0DFA65976DA7822DB99118ABF2A50CC9
                                                                                                                                                              SHA1:A06FEEFFD56B3EF7A227E64099FC0213514D7879
                                                                                                                                                              SHA-256:F9F61393559BB1D76AB630B11953EC20C7A0D5979E48F27279E7BB0A92ABDA26
                                                                                                                                                              SHA-512:41CB3CCC7A2AEDB2B17517DE1DAC905ADAF9DB797E1FD487E7853438C2936096212582B20BFEFE03E267E0E1650AF503B802A13C43F0A55A6B803BEB1F93EE56
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....;f..........".......#....................@.............................@6.......5...`..........................................w(.U...Xw(.h.....0.p.... ...*..H.4......6..-...Y(......................X(.(...P.#.8...........x.(.....xv(.@....................text...e.#.......#................. ..`.rdata........#.......#.............@..@.data...|.....)......l).............@....pdata...*... ...,....-.............@..@.gxfg...04...P/..6...:..............@..@.retplne....../......p...................tls........../......r..............@....voltbl.F...../......v..................CPADinfo8...../......x..............@...LZMADEC......./......z.............. ..`_RDATA......../.....................@..@malloc_h......0..................... ..`.rsrc...p.....0.....................@..@.reloc...-....6.......4.............@..B........................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\@PaxHeader

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):27
                                                                                                                                                              Entropy (8bit):3.736006946447657
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:5M/SNVDzNnv:S/MVnv
                                                                                                                                                              MD5:FC8EE03B2A65F381E4245432D5FEF60E
                                                                                                                                                              SHA1:D2B7D9BE66C75CCF24FCB45A6D0DACEDD8B6DD6F
                                                                                                                                                              SHA-256:751A04263C2EBB889FDCD11045D6F3602690318EBAAA54F66E1332D76DDE9EF4
                                                                                                                                                              SHA-512:0837F2B22C9629990165C5E070E710A69AD4951B7FCFE28BD52354C4B8A7246672497B8AAF521A8773C7EC2A4249FC4318330948AB0D8DB8C6C74DA57B32F1C4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:27 mtime=1711026622.653471.

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserCrashHandler.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):152880
                                                                                                                                                              Entropy (8bit):6.814650653995357
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:rPfhJk6XlsbrElrmPARuDnQeH9E3DrhsMslRj53Xh6KlBrUAyDfUgQ1ewnI:bfYKsHKmzJK3DrOMA53Xh7l2/vwn
                                                                                                                                                              MD5:F73E60370EFE16A6D985E564275612DA
                                                                                                                                                              SHA1:2F829A0A611AC7ADD51A6BC50569E75181CDFD58
                                                                                                                                                              SHA-256:9CF076866935A0C64366EFAEFF2EC76D45AC816030EBD616FD5DEFB1870BC30E
                                                                                                                                                              SHA-512:2E44E87C285BB7B72D45C8119D08EA6F2D13CEA77CF0005A3CF530790BB86C7F2DF7C5EDAC9D86C9D7214ABB224738C3BF6B31F6BF104051512BB1DE133042DC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........2R..aR..aR..a...`X..a...`...a...`F..a...`t..a...`C..a...`@..a...`Q..aR..a...a...`S..a..%aS..a...`S..aRichR..a........................PE..L....*.e.....................p......T.............@..........................P............@.................................d'..(....P..............H&.......@......L...T...............................@............................................text............................... ..`.rdata..<].......^..................@..@.data........0....... ..............@....rsrc........P.......*..............@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserCrashHandler64.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):174120
                                                                                                                                                              Entropy (8bit):6.56447806246944
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:8zfXhld4VAmlAfFUtpsIiUCm7/rhsMslRj53Xh6KlBrUAyDfUgQPqEZ:2XhP4VHlAfFU57rOMA53Xh7l2/8
                                                                                                                                                              MD5:DEEF1E7382D212CD403431727BE417A5
                                                                                                                                                              SHA1:FAC0E754A5734DD5E9602A0327A66E313F7473BB
                                                                                                                                                              SHA-256:7D410E9EABD086827B16C89EE953A643C3E2F7929616C0AF579253FD8CA60088
                                                                                                                                                              SHA-512:6B472A57FB89B128AAD9AB6313A9CE8B171F7D73264C67F669ADC5CF1F0421D81F654DAD1419B620476ABB59DD54E1AA03A74A26C5C93813F6FB8575FBD97D4D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g0...^...^...^.;v]...^.;v[.U.^.;vZ...^.s[...^.sZ...^.s]...^.;v_...^..._..^.sW...^.s....^.s\...^.Rich..^.........PE..d......e.........."............................@....................................~(....`..................................................l..(...................Hx.../......T...pW..T............................W..8...............@............................text............................... ..`.rdata..............................@..@.data................f..............@....pdata...............r..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..T............p..............@..B................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):209736
                                                                                                                                                              Entropy (8bit):6.338157428900468
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:IjbidjsOxTePH/lqa8ggDemWSzuwJWwqjPcbhsMslRj53Xh6KlBrUAyDfUgQh7sb:Mtqa8VxJMUbOMA53Xh7l2/64U
                                                                                                                                                              MD5:CBCDF56C8A2788ED761AD3178E2D6E9C
                                                                                                                                                              SHA1:BDEE21667760BC0DF3046D6073A05D779FDC82CB
                                                                                                                                                              SHA-256:E9265A40E5EE5302E8E225EA39A67D452EAAC20370F8B2828340BA079ABBBFD3
                                                                                                                                                              SHA-512:5F68E7DFFDD3424E0EB2E5CD3D05F8B6BA497AAB9408702505341B2C89F265EBB4F9177611D51B9A56629A564431421F3ECB8B25EB08FB2C54DFEDDECB9E9F2E
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T.<r..R!..R!..R!..Q ..R!..W ..R!..V ..R!B.V ..R!B.Q ..R!B.W <.R!..S ..R!..S!s.R!H.[ ..R!H.!..R!...!*.R!H.P ..R!Rich..R!........PE..L...u*.e.................<..........;z.......P....@..........................@......B]....@.................................`q..x..................H....1... .......]..T...................@_......P^..@............p..\............................text....:.......<.................. ..`.data........P.......@..............@....idata..P....p.......J..............@..@.rsrc...............T..............@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdateBroker.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):154448
                                                                                                                                                              Entropy (8bit):6.807867336192154
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:Rf3H2h0KqYLKFBqrE0DHX7+n23LbhsMslRj53Xh6KlBrUAyDfUgQvcmsViP:d3HUqKmq5X3LbOMA53Xh7l2/ysV
                                                                                                                                                              MD5:DB30F912115EDD14D1243AD3F19DD4D9
                                                                                                                                                              SHA1:1708B6E7F8DF03D121C6415FAC9CBB2B11BF57BD
                                                                                                                                                              SHA-256:D5C7600C6A2A070A504F850CC93AD727F1247A8BDBC90D1D48205A57AC1D2115
                                                                                                                                                              SHA-512:FA7921E4F93262B50B10ED49330676D33D67F623DE2834A3538EFE96138B8008516D208421573D2F8FC80BFCD98926758730036E4C6CEE5E2C828C46A44F9F77
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.z..@)..@)..@)>{C(..@)>{E(T.@)>{D(..@).~E(..@).~D(..@).~C(..@)>{A(..@)..A)..@).~E(..@).~.)..@)...)..@).~B(..@)Rich..@)................PE..L....,.e.....................r....................@..........................`......_.....@.................................$8..<....`..............H,.../...P.......,..T...........................P-..@............................................text...s........................... ..`.rdata..b^.......`..................@..@.data........@.......&..............@....rsrc........`.......0..............@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdateComRegisterShell64.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):438608
                                                                                                                                                              Entropy (8bit):6.458531377188769
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:VMfuNoVPNlu9wHXNiOc2bbNzoonn0JG+U:VrN0FviOc2bZz70t
                                                                                                                                                              MD5:2A3AD7362E6C8808FBB4D4CCABA4ED4A
                                                                                                                                                              SHA1:3F896F7DF7FE202F4A717713C503665BB4DCAED6
                                                                                                                                                              SHA-256:4DCD341907880C8DEA840819628B19C5EA42CA2B5C61AD57147D0AC7DA9B6759
                                                                                                                                                              SHA-512:892042AC713E4D5B488262A584355DAFA18D967035788799C1773EB39A4616461BEB9D79A230D9F85CDEFD1B4076B8A5E1D4BDE17254BFF1F08C3EBA56469679
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5..PTg.PTg.PTg.$d.[Tg.$b..Tg..!c.BTg..!d.ZTg..!b..Tg..!n.kTg.$c.ETg.$f.MTg.PTf..Ug..!b.QTg..!..QTg..!e.QTg.RichPTg.................PE..d....-.e.........."............................@....................................b&....`..................................................................p..t4..Hx...9......d...P...T.......................(.......8............................................text.............................. ..`.rdata..x{.......|..................@..@.data... 8...0......................@....pdata..t4...p...6..................@..@_RDATA...............d..............@..@.rsrc................f..............@..@.reloc..d............j..............@..B................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdateCore.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):525304
                                                                                                                                                              Entropy (8bit):6.843863784629847
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:8Qjngc7LQE78QMC8W5cSTskaw3YfhnsgqX:8Qjnn78ScSThaw3Yf9KX
                                                                                                                                                              MD5:DD5DC945CD848BF503862D0A68C3EA5D
                                                                                                                                                              SHA1:9B277A0C733ED5698B0656DA8C3B99D2F90C7EF8
                                                                                                                                                              SHA-256:8CC98345E367B083F545ACE66D93BF69E03A4FA08B84805A9925FA4C94EF3F8F
                                                                                                                                                              SHA-512:F6EAB8422BDE24D89A7723C6175B4197A50E18AA0BB5B8F419E5A23B265D85DCAACAF136B8F6EF6BBF2BD6C0EAECD8F86093F594FB98E596F4B39E9C6FF227E1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U...4.P.4.P.4.P.D.Q.4.P.D.Q84.P.hjP.4.P.A.Q.4.P.A.Q.4.P.A.Q.4.P.D.Q.4.P.D.Q.4.P.D.Q.4.P.D.Q.4.P.4.P.6.P.A.Q.5.P.AhP.4.P.A.Q.4.PRich.4.P........PE..L......e.....................f......0t............@..........................0............@.........................................................H....;.......A..@v..T....................w.......v..@...............8............................text...*........................... ..`.rdata..............................@..@.data...$G..........................@....rsrc...............................@..@.reloc...A.......B..................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdateHelper.msi

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: AVG Update Helper, Author: AVG Technologies, Keywords: Installer, Comments: (C) 2017-2024 Gen Digital Inc., Template: Intel;1033, Revision Number: {A87CFB5C-61CB-4FE0-9552-F287D1928D95}, Create Time/Date: Thu Mar 21 12:47:58 2024, Last Saved Time/Date: Thu Mar 21 12:47:58 2024, Number of Pages: 300, Number of Words: 0, Name of Creating Application: Windows Installer XML Toolset (3.11.1.2318), Security: 2
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):32768
                                                                                                                                                              Entropy (8bit):3.7109485435414107
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:jPeAyDBOS10ey3M5ICNsSmAoQx5Pey3M5IC0ioXh:peBOS+eWMmCNseeWMmCE
                                                                                                                                                              MD5:66140E921FFC869E5DBD7D0337503F1A
                                                                                                                                                              SHA1:CC26B0818DBB2A4D3E242FD1CAF7B45E036961C0
                                                                                                                                                              SHA-256:D2EF84B42A4358E58F5566D842C389B229BA073FCEF20B2A3007B6CE76A06D2B
                                                                                                                                                              SHA-512:EB4A787E76A6700112349B5EBA78A4467BA4A2364D30EADE70ACBA480E4DF1C5D48BCB31CA136F81B350C466911AF97CB1DA1BA964C2D35003A4E3E86C738772
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdateOnDemand.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):154448
                                                                                                                                                              Entropy (8bit):6.808581934006418
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:rnM/2hkKqELSFBqr00nHu9eF23TbhsMslRj53Xh6KlBrUAyDfUgQ/DgM/h:LM/0q2eqG3TbOMA53Xh7l2/fM/
                                                                                                                                                              MD5:772D18249265097851DEE4129C277653
                                                                                                                                                              SHA1:E55CCC571E5180A3D5F395D4D00974CB70493E5B
                                                                                                                                                              SHA-256:2496F8D3C663D72B547C16371DEA14CAE69EE6CBC90F8CA94BA942D095FE897A
                                                                                                                                                              SHA-512:DB423FE798ACAA10D367B5836D5A33D4B522C7B0391C8FC38B5EB1810F5C66C8038A85CB7716652D0D9243688B4D593A6F968B947ED666B3DB32892304F47FBF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.z..@)..@)..@)>{C(..@)>{E(T.@)>{D(..@).~E(..@).~D(..@).~C(..@)>{A(..@)..A)..@).~E(..@).~.)..@)...)..@).~B(..@)Rich..@)................PE..L....,.e.....................r....................@..........................`............@.................................$8..<....`..............H,.../...P.......-..T...........................`-..@............................................text...s........................... ..`.rdata..b^.......`..................@..@.data........@.......&..............@....rsrc........`.......0..............@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdateSetup.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1688480
                                                                                                                                                              Entropy (8bit):7.938697411754708
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:49152:RbGTBlB4+Nlt3xF+KJh3dnd5OZ/H84G0W/4qer:BG1jhv+c1dnd5OZk4RW/
                                                                                                                                                              MD5:9750EA6C750629D2CA971AB1C074DC9D
                                                                                                                                                              SHA1:7DF3D1615BEC8F5DA86A548F45F139739BDE286B
                                                                                                                                                              SHA-256:CD1C5C7635D7E4E56287F87588DEA791CF52B8D49AE599B60EFB1B4C3567BC9C
                                                                                                                                                              SHA-512:2ECBE819085BB9903A1A1FB6C796AD3B51617DD1FD03234C86E7D830B32A11FBCBFF6CDC0191180D368497DE2102319B0F56BFD5D8AC06D4F96585164801A04B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......].T...:...:...:...9...:...?...:...>...:.K.>...:.K.9...:.K.?.).:.A.3...:...;...:...;.n.:.A....:......:.A.8...:.Rich..:.................PE..L...p*.e.................n...........R............@.................................+/....@.....................................x.... ...[..........H`..Xc..............T...........................0...@............................................text....m.......n.................. ..`.rdata..Fr.......t...r..............@..@.data...............................@....rsrc....[... ...\..................@..@.reloc...............L..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdateWebPlugin.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):154448
                                                                                                                                                              Entropy (8bit):6.808400148672981
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:kHX/2iBVBAbX4pbbrWBAXJsl+B2wnbhsMslRj53Xh6KlBrUAyDfUgQIBTP3Fv:eX/LAb+btirwnbOMA53Xh7l2/hTP3
                                                                                                                                                              MD5:4263BCB0124FAEDC84CB07B46CBEAC0A
                                                                                                                                                              SHA1:B93A75DBAC32E10D474A2D05A660C4FF2FFF725F
                                                                                                                                                              SHA-256:8BBE2F03F0740CFF0417BA798A632526C7F2F397B8C1907BAA386BB96B7847EA
                                                                                                                                                              SHA-512:2F811022E55DD6E6F797EB2ACF77B315CADF34D7AB1670CFADCC993BB1EC081BBB908291CBAF901B2044A146ED2DB58546A955761236644B9C5AAB0490B20DB0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.z..@)..@)..@)>{C(..@)>{E(T.@)>{D(..@).~E(..@).~D(..@).~C(..@)>{A(..@)..A)..@).~E(..@).~.)..@)...)..@).~B(..@)Rich..@)................PE..L......e.....................r....................@..........................`.......V....@.................................$8..<....`..............H,.../...P.......,..T...........................P-..@............................................text............................... ..`.rdata..b^.......`..................@..@.data........@.......&..............@....rsrc........`.......0..............@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\acuapi.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):561472
                                                                                                                                                              Entropy (8bit):6.894656357233734
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:NfJq+D0CU+l6jkqRmZivOzqA+0gF7IZDphezIhSMXlL5hrDqOO87:zD0uZivOzqApA7IZ1hezIhSMXldFNO8
                                                                                                                                                              MD5:3C43E274193213B6B955AFEFB645F007
                                                                                                                                                              SHA1:EBB2703E2626F2DDE67C111342C47B20BBC275FA
                                                                                                                                                              SHA-256:C1365762EED2B4950B8702D0508BF84CAF2980F9C06840D82C4E8F9E5E83D8F3
                                                                                                                                                              SHA-512:134C8E745CD0604FA8489B924DDDA5229656427084981437FEA5A3E96EFE0D75B898BBF8EBA3BD27867500CB884A39ACA8779AB1C62C0C95F69F0A6FB7A69B30
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n..*...*...*...r.../.......%.............=...x...%...x...?...x...g.......-...*.....r...(...r...+...r...+...r...+...Rich*...........................PE..L......e...........!.........p......................................................Gr....@.............................l...|...(....@..p...........HT...<...P...8......T...................@.......h...@............................................text............................... ..`.rdata..............................@..@.data....-....... ..................@....rsrc...p....@......................@..@.reloc...8...P...:..................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\acuapi_64.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):719072
                                                                                                                                                              Entropy (8bit):6.675163105242217
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:LPaBHtQ7iF5W+cVU/5vJ8XVoA9MUUtEnWe7ZNgI8Qz//pLk0xTxcJzPz/s2p/Z+7:LPaH2V25vq+vRG0e3hezIhSMXlxM
                                                                                                                                                              MD5:B1624894C7A3B09042B2DBE0FA040663
                                                                                                                                                              SHA1:0466D959D3263F801925058543E16C864FD95C07
                                                                                                                                                              SHA-256:12D68A3F503E82AA68AE0CA60C3ED2AB5006987D89BBD9B63BC149C6E359CF18
                                                                                                                                                              SHA-512:A5E5A8882A94ED5FBD4A4787D8580975A6EC17F76B7044B138A178598DA9248F92F8D137C0A1FF6A81329215C9300C63DFB7C8452ADB386CD537A6B4FFC4407F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3.b2w..aw..aw..a/..`r..a...`{..a...`...a...`c..a%..`y..a%..`}..a%..`8..a...`p..aw..a...a/..`u..a/..`v..a/..av..a/..`v..aRichw..a................PE..d...+..e.........." ......................................................................`.........................................@A..p....A..(.......x........A..H....B......$...x...T.......................(......8............................................text............................... ..`.rdata...}.......~..................@..@.data....?...P...&...8..............@....pdata...A.......B...^..............@..@_RDATA..............................@..@.rsrc...x...........................@..@.reloc..$...........................@..B........................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdate.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1476176
                                                                                                                                                              Entropy (8bit):6.739577754693322
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24576:TuRNP0rZTrG+t3k1nRjaun62tjPABpIlYsgYfKf00KFq5VmfvwwTZGuTAfuzV:OP0tP3kVMunHtjP5Ss3QKFumfvwwTYuv
                                                                                                                                                              MD5:04A6438C50564146E880C5EB9D57905E
                                                                                                                                                              SHA1:EDF5D454DE99159D832CC9BD0D8DBE132D749804
                                                                                                                                                              SHA-256:26109D47BF9960E531888E6C545CA8CFC24FEE2202B549DF29FB8BF9C58E0812
                                                                                                                                                              SHA-512:8705D0AB2F8A6C1EF567AD00B33FF2CCA01391B105EB0ADE201D981F091E4BA87E709860AB9849BF9781698FB42AB8EFE53EA731AF310781766BACE1EB1DC19D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........n%.B.KMB.KMB.KM..LLC.KM..ML@.KM..HLP.KM..NL..KMsS.M@.KM.zOLS.KM.zHLZ.KM.zNL..KM..OLc.KM..JLi.KMB.JM/.KM.zBLr.KM.zKLC.KM.z.MC.KMB..My.KM.zILC.KMRichB.KM........PE..L...<,.e...........!.........d......oG..............................................R.....@.............................T............@..0s..........H*...\..........d...T...............................@............................................text............................... ..`.rdata..............................@..@.data....[....... ..................@....rsrc...0s...@...t..................@..@.reloc...............^..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_am.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):44016
                                                                                                                                                              Entropy (8bit):4.850730859886352
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FrIC84k4+R2B1KAIYiifNlBAM+o/8E9VF0NyB:Fv8ZJ8KYiiVAMxkE
                                                                                                                                                              MD5:BA03B29D5D44341084EB06BEA8F1E702
                                                                                                                                                              SHA1:7D8DD7556EA5E299B55DDC7477CA758FE2C64F48
                                                                                                                                                              SHA-256:6A6AAD33E2910C29A6D919AAD074D89359C5E6723CED7BA4E215A62E9513749B
                                                                                                                                                              SHA-512:29F902587B7078DEB12BEE6BF9993748109749EC12E6490D5F84BC9C532A5A1F414149D5760641EF052611BF2D441423D115DFB5A4C4C6F5E6D6A1F386924CF2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L......e...........!.........z............... .......................................L....@.............................D....0..(....@...p..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....p...@...r..................@..@.reloc.. ............~..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ar.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):42960
                                                                                                                                                              Entropy (8bit):4.833178144350414
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FfobWdkCAu+JGRF9IYiifFWAM+o/8E9VF0Ny1Hi7:FuWdkCAd9YiiIAMxkEm
                                                                                                                                                              MD5:9C77BE0843F0FE4864A04F8D5F24A593
                                                                                                                                                              SHA1:BE03ADB4D3C33520E652C7A6EE45F09D5FF54A54
                                                                                                                                                              SHA-256:39547FA5D7B93856235288B1021699B4F36F0BEA10B10D6B89EA184A3AD77BB1
                                                                                                                                                              SHA-512:F504C98B03A5D72C078B38A2CC4FDD94DBED159F5A2ED47C2C4A53FC6EC8A3B1FD969D5AD85FC7503E64427A36ADEE7A14F15F1275A9194103E43C8A8EE45D28
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L......e...........!.........v............... ......................................`.....@.............................D....0..(....@..Hm..........H|...+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Hm...@...n..................@..@.reloc.. ............z..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_bg.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46064
                                                                                                                                                              Entropy (8bit):4.868686647522131
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:Fg+LXdckieGZBOcIDDN9IYiifjyKmAM+o/8E9VF0NyQe:FfXVEDXYii6AMxkE/
                                                                                                                                                              MD5:C0B41217FC33A6A53EC69AE7399460F2
                                                                                                                                                              SHA1:D7DD8D543B7297F1A1E138EFA1806972C9489C3F
                                                                                                                                                              SHA-256:D75A1A41AD7E5277576E3BDF35A858BE3A6F540D21C8AB4156C842D8F1B3295B
                                                                                                                                                              SHA-512:37ABB726B78421AACCDBC94B358CDA6B581E89AC519258EB39C6A7F0706CFC64C3A96F5C29539BA67C6E2D2AFD6F10B6B0C063B54366C03376CE234D132A8253
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L......e...........!......................... ......................................&_....@.............................D....0..(....@...x..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....x...@...z..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_bn.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46064
                                                                                                                                                              Entropy (8bit):4.934496971225395
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FbmKgvUx7tYF7qWF0FrHF6rjbmBwT1nUrIYiifb5cAM+o/8E9VF0Ny1oS:F1grBF0FrFnBwhUUYiimAMxkE4
                                                                                                                                                              MD5:AEDF6D96CCB64F488379BB1FE65F697A
                                                                                                                                                              SHA1:901BBB7873D8F698F49C4B6BE74FB50B353D7B5E
                                                                                                                                                              SHA-256:941D22186EF1BFE27052E78D21944D6088CEA152D1EDE51452F04FB032C92F90
                                                                                                                                                              SHA-512:D1D889A1FE75924F3569E07D9EE3F552AFC02165210F5C439D4697BE898B72DB397BB89E7D0706259F92C1CB5759009F9E1BA5C52F764E63514B3DA41DADA1CC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L......e...........!......................... ......................................7.....@.............................D....0..(....@...y..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....y...@...z..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ca.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46064
                                                                                                                                                              Entropy (8bit):4.658137928117167
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FgxEC02ArzVuJG4bPyqoIYiifpyKAM+o/8E9VF0NyI5:F602ArBuh/YiikKAMxkEY
                                                                                                                                                              MD5:F951CF3CA93E5AE5FC1CE2DA93121D98
                                                                                                                                                              SHA1:15BC869406857437BABE41CD3F500C356913499B
                                                                                                                                                              SHA-256:EB00CAD19ED1D16F52928962F2CC6231D65EB74B2314976EBEB1EC860103E746
                                                                                                                                                              SHA-512:B77086AD2B39723D697D7839D9243C1C0769A2CB0F6287CD3F2D64EABD6A48D8FC2D253E9089C6586637ED5DC5970C2608615FE77CEF5003F0C4D53401EF73BC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L..../.e...........!......................... .......................................N....@.............................D....0..(....@..(y..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...(y...@...z..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_cs.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45040
                                                                                                                                                              Entropy (8bit):4.699208339439057
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FSWtuBWpKJkbYAA+fJ1dcIYiifHB1nIAM+o/8E9VF0NyVExg:FH/b7YiivPnIAMxkE2
                                                                                                                                                              MD5:7F3DCD851645D3D75F636C8440FB057F
                                                                                                                                                              SHA1:85DEBE41DDCB46555A0D00795E41E460A35583C2
                                                                                                                                                              SHA-256:0B31785D1931580CAD5EF16D4FF5723802D12C38B56746E70FCF91D71162E043
                                                                                                                                                              SHA-512:D0D21C397899AAA6A718B77195A6AF1556309615616FD6583ECB84B04AA7087E76EB5FDD6CAE0A4FF1C0F85BF72E1F51AE002042078095F640EB95DA363889E4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L..../.e...........!.........~............... .......................................7....@.............................D....0..(....@...t..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....t...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_da.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45040
                                                                                                                                                              Entropy (8bit):4.655648919342282
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:Fx9zRfNnwtpY6PFuC/rIYiifLPhjAM+o/8E9VF0Ny6:FLTnwkOLUYiijpjAMxkE
                                                                                                                                                              MD5:9A421423686559027E4301D36BCF58B2
                                                                                                                                                              SHA1:9669424F4E7C765DDB917A515D5A8B1486F87DAF
                                                                                                                                                              SHA-256:9D8FF148793D99974FAB93F38027E1999323A48620B303F82170751BE5DD6B69
                                                                                                                                                              SHA-512:F5D62FE17A820323C4B1832CD3BD9C8FA291D44DCEB88A8A1A8F94C6166E550AB9BAF9357C5EC3388230BC75F0CCD3AA2D5247FA5D242013D22C61001128A951
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...&/.e...........!.........~............... ......................................O.....@.............................D....0..(....@..@u..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...@u...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_de.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):47088
                                                                                                                                                              Entropy (8bit):4.6512246006331335
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FmIxYUj8gtdF0Me39ACYadIYiifgoZAM+o/8E9VF0NyO:F9neMe39ATlYiiJAMxkE
                                                                                                                                                              MD5:1C15851D9DD22E4AE3F3BF249DA79035
                                                                                                                                                              SHA1:60FC5652B5E1C55056C961D4D3B961492CB3432B
                                                                                                                                                              SHA-256:A9DD72A08C0C58A71B2289D76EFAE681A5C8EB5FAF73E49B873F15BA4050BAA6
                                                                                                                                                              SHA-512:6DA386C35B317F39613DA73340631F927606BCCD0A8C626537EDA896EB32C9A2ED1D71C7CF838F1A4B90553F3F788EEB5E02FE84774FB0AD2F574BF4E4D7E248
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...7/.e...........!......................... .......................................w....@.............................D....0..(....@...|..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....|...@...~..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_el.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46576
                                                                                                                                                              Entropy (8bit):4.945135602641649
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FUJKFEDleILkSIrGCSqlIxRFiAhAu8zBdfsBsTbCBRIYiifjeQMVQAM+o/8E9VFj:FPOZlLO+R5U/RYiiaHyAMxkEi
                                                                                                                                                              MD5:0D15748F01DF49DAE986F1E27DC098EF
                                                                                                                                                              SHA1:35A435BDAAF47795977B28CDAE2E4EA1FDAE73A3
                                                                                                                                                              SHA-256:DF13C38061CB0B02DD8A9023A17DA0BBE1CDA6FDEDAD5203129FC702C7FDD9B1
                                                                                                                                                              SHA-512:290E9936F50E3BD11C1B9D28DECF3B43F5E23BBFF16801E7B0491690773D057B6BCDCF48C48A7EE16FA2400723B3E974E2B74E3899590A8E660C2E9C78B9D141
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...E/.e...........!......................... ......................................8w....@.............................D....0..(....@..x{..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...x{...@...|..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_en-GB.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):44528
                                                                                                                                                              Entropy (8bit):4.641074368533252
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FzGT0agyh6Qu65PmiIYiifK91lwWaAM+o/8E9VF0NyR:Fg0agyhi9YiiewAMxkE
                                                                                                                                                              MD5:02465169CD873C4492196E03457F2771
                                                                                                                                                              SHA1:837CA5E54A8C12577D0D05A32996DFC04067C5EA
                                                                                                                                                              SHA-256:4EB9EDF550BF1F66382E5D8BD4958438891CD2CA46557D14F4B945DC176EC025
                                                                                                                                                              SHA-512:E73B5F3951050F2903B80B89D2B9FD9EBF69ADB922EB8238EF4C01F413AE67727D7598D4AC15F7AC8B9257AEF0139E0924C70C5898357142A303D7E2B15394C3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...`/.e...........!.........|............... ............................................@.............................G....0..(....@...r..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....r...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_en.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):44016
                                                                                                                                                              Entropy (8bit):4.656047937354881
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FwGSdagyWmpR/95IYiifd3xZAM+o/8E9VF0NyV1Fl:FGdagyWqYYiipnAMxkEB
                                                                                                                                                              MD5:418853FE486D8C021D0CCA2E85A63D63
                                                                                                                                                              SHA1:9504500A7B5076579D74C23294DF4BDB1B7C517D
                                                                                                                                                              SHA-256:4CBB2591C1EEDA32BCF295685C993CE4D16ACC968697FA12E2A00A1B7C4B37A3
                                                                                                                                                              SHA-512:DC2AB4E2056E6D73A274D700BC16F75C7C687B35874029C1908B183428DEC010373045D4A52EB3F5745F8B91D624CF5D40CD7F37E353F3A41348E2A054A266A3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...Q/.e...........!.........z............... ......................................)O....@.............................D....0..(....@...q..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....q...@...r..................@..@.reloc.. ............~..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_es-419.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45552
                                                                                                                                                              Entropy (8bit):4.648374531404977
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FlPhgKHfN4p1WY+IYiiftrb+AM+o/8E9VF0Nyy:FTgKHfN477YiixaAMxkE
                                                                                                                                                              MD5:3E5971E8559C77E8901CE30D14034730
                                                                                                                                                              SHA1:04CC21AC4A84ABD29F7D7585282345881FD81721
                                                                                                                                                              SHA-256:613418B8779F7440B88F1734D6C514706DF9DC9A58A623966CC1C9BA4E29C28F
                                                                                                                                                              SHA-512:B4592B25CF676DB6D6DE1BE811C39BDEECC24BBFD4DC72FA4B3F97DE866F9B0FEC7C85F7D56F048F61829C1D8B4109E4A0C7E14A9E410E30A6A8DA702941E00E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...z/.e...........!......................... .......................................X....@.............................H....0..(....@...v..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....v...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_es.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):47088
                                                                                                                                                              Entropy (8bit):4.635331722364897
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FcbK5mFNz51BYn2IYiifI4urAM+o/8E9VF0NyXM:F/mFNN1AYii7urAMxkE
                                                                                                                                                              MD5:5F8EA18786D5EF1927CD95537ABC3AE0
                                                                                                                                                              SHA1:5530650ECC719D83B7AA89E0B326B5698E8ADDA2
                                                                                                                                                              SHA-256:FA416294B078226A8919DBB8F75533A6EF96D63D5BD17AAC854EAE68791433CF
                                                                                                                                                              SHA-512:577DC7D19E4443E8AEDE759A781826C091C17D12FB06E89B1306133F21E01DAB919045183A916E1B5647DDF485134A8459745A9199DF5C7E36ABE192645D8E25
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...m/.e...........!......................... .......................................3....@.............................D....0..(....@..h|..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...h|...@...~..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_et.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):44528
                                                                                                                                                              Entropy (8bit):4.646586692890864
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:F1JQrrbDFbDZETJXTSQW1o5IYiifuPMAM+o/8E9VF0Ny3Qjsa:FMf96dHqLYiitAMxkEwP
                                                                                                                                                              MD5:5029406D9202D6F2F279FDD3A06F55A1
                                                                                                                                                              SHA1:DCCA8BF9392FAA0038C6CB5D25929726B16804AF
                                                                                                                                                              SHA-256:CAC545E04D701C39F4A730AEC4C3DAD177D8EA4BACA10651F150925644874864
                                                                                                                                                              SHA-512:519538E05F8E21966E4878291692CF25057BBA3C993C0034A33B1DA7C9EB0A8FB881565717CEB6C1139FD601B73B1F1E2AA46E20AEB6B93F897CD2EF93172934
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L..../.e...........!.........|............... .......................................:....@.............................D....0..(....@..xr..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...xr...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_fa.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):44016
                                                                                                                                                              Entropy (8bit):4.842490710779511
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FhWHNZNIY531DQIYiif/qoAM+o/8E9VF0NyB:FqHFVYiivAMxkE
                                                                                                                                                              MD5:8564514501256FF045CF7AA6C1B5A797
                                                                                                                                                              SHA1:40B9AA8D04C48FE2ECF193C2089418CCC938676D
                                                                                                                                                              SHA-256:F3F46A6DA6C8CCB3CE7FDD0CB5882F45523DECCA95852B8C775BB90F8E92C1B3
                                                                                                                                                              SHA-512:701077C8A1C70C1BD0C35F54AA838DBA7B7B6F832E0EF2776673092FCA546276166C3638676451C9655086B740B9E193CD54F952FD5FCA481B964083B881BCC2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L..../.e...........!.........z............... ......................................y.....@.............................D....0..(....@...p..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....p...@...r..................@..@.reloc.. ............~..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_fi.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45040
                                                                                                                                                              Entropy (8bit):4.660116656094835
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FinpDGfEzPhXY7R799hKh1GA81IUzNIYiif26AM+o/8E9VF0NyeW:FgGfEVmNgEIUOYiijAMxkEL
                                                                                                                                                              MD5:57DAD7C22BD635A5AF8FCDCD63D4E530
                                                                                                                                                              SHA1:8AA11EA5C1CACD9B23C29989F22E82C43C827D0E
                                                                                                                                                              SHA-256:1E0D05927A455115265DB9308E0F78FFB7BBB5442F36B8483549EFBE415454A2
                                                                                                                                                              SHA-512:4236609E37EC41BF46D0F45E228C9021C1624E2F98A642EAB513D290A4482DA13764FCC2D044F78EBDC09E0CFC63A251678D169CB33E251D6F6D5DE9B96C31B6
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L..../.e...........!.........~............... ......................................L.....@.............................D....0..(....@...u..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_fil.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46064
                                                                                                                                                              Entropy (8bit):4.643366949275377
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:Fe7+SUNPli+B3RVaw7yzmDqEKIYiifAnAOGAM+o/8E9VF0Nycd:FLSU9li+B3RVawWwRYiijOGAMxkEM
                                                                                                                                                              MD5:5ED0105F4043466A99557DDE1F70E97F
                                                                                                                                                              SHA1:C57C935CC4B25B6375AB3FCDFBB265F4C586EC3E
                                                                                                                                                              SHA-256:CFBE0120DDF8D5574F7C44C85488F53AECEC4DF9BFB25F1CEFBABCAD5AF46096
                                                                                                                                                              SHA-512:4FA641810F758E0031388EC146467FC130780E2F2CC8495B6A2FFF0679D7BCBE7526356F85A97B5338E84D791BA14E812B2C182FDAE01763640BE3324FB59526
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L..../.e...........!......................... .......................................d....@.............................E....0..(....@...x..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....x...@...z..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_fr.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46576
                                                                                                                                                              Entropy (8bit):4.662391785374034
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FaBMC98EoIcpW4x4QNIYiif57kAM+o/8E9VF0Nyjz0:FPCaIcNMYiieAMxkE1
                                                                                                                                                              MD5:8DDC3F7276C12AC407CADCDA6E2A3E12
                                                                                                                                                              SHA1:78C5E802F67C8B6AE3FE13202E6A54D3CCA69DF4
                                                                                                                                                              SHA-256:7F2F0F9F443A022F5AEDACC40C28D0654FEC488F34435C75979118464256A8B7
                                                                                                                                                              SHA-512:0D05BDD2D5E9F36EB09182E8B13507BA03E256C4AADB77BBFEDF29584A47FD1E0733A825A3F687D3058E53C8075CAF6DD9D24EC93F1BDD58CA97106827323540
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L..../.e...........!......................... ............................................@.............................D....0..(....@..x{..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...x{...@...|..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_gu.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46576
                                                                                                                                                              Entropy (8bit):4.921652037395085
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:F7Dwh3UreAV4DzYCQ+fwmkIc1r2GIYiifpiFAM+o/8E9VF0NyzEy:FwhUre7VbkSbYiiIAMxkEm
                                                                                                                                                              MD5:A4061E8408CC59CB898ADFDC4F173278
                                                                                                                                                              SHA1:AE34E3058A40449481590BB3A63AA0225B4F6F98
                                                                                                                                                              SHA-256:E033C950ECC6333DFCB944E70622E77A6498BA0E23FD144117DBE9A2A0C15BE6
                                                                                                                                                              SHA-512:D8A847E9A21C86C7B9B072E16914F42185E3C0E1D99F6EA5259382EB0FB89578C7A7F9F62F892F1D20BE180DFC327BC076EA038057895C8B92CB1F0C053E0B2A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L..../.e...........!......................... ......................................".....@.............................D....0..(....@..0z..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...0z...@...|..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_hi.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45040
                                                                                                                                                              Entropy (8bit):4.88079299762203
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:FkmZ6AN6Aaqxzxm8qRXtpqCpTyYiiyAMxkE:FkmUXpW71x
                                                                                                                                                              MD5:38525B8A1B15A8AEB4FCFC8BEE8358BC
                                                                                                                                                              SHA1:AC2BA33B8AD778A8165C87B579DAD0DBEF5BED75
                                                                                                                                                              SHA-256:271E83BC86E490CD5B6CB9CB34057C7684D233C56A53F4F553AA07507C9DAE52
                                                                                                                                                              SHA-512:AD8DF196174CEEADCE4588DCD365066665267B922078D92B328BA661A4EBFA6D06B4263A4B8A28E4EFB4D86E1140D71A3C3BF4B7B60970AA20552AA7F0C73ACB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L..../.e...........!.........~............... ...........................................@.............................D....0..(....@...t..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....t...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_hr.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45552
                                                                                                                                                              Entropy (8bit):4.665910901316835
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:Fzmx1myNOXz19zzMH5KBL/r1tvmIYiif+0YAM+o/8E9VF0Nyr:FE1ma5oL/JpYiitYAMxkE
                                                                                                                                                              MD5:27C0DBD61A71420BB4D1A0BE2373A175
                                                                                                                                                              SHA1:47B4C107B711CAF5A6B2978BD6FD6B53EBDEC5E3
                                                                                                                                                              SHA-256:43191A4C507A112E96E06F959B6CF78406BF970B021AD8D7DB59D1B9C52779BD
                                                                                                                                                              SHA-512:D1F20E9A628BDCBD26B8D5DE89B87BDBC8DAB871651C86D47C023DAEA86C7ADA0A565FDD05B48C7643A63DB044639F4EB89D1640E58C9B32722E4926C3C5E72A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L..../.e...........!......................... ......................................'e....@.............................D....0..(....@...v..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....v...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_hu.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45552
                                                                                                                                                              Entropy (8bit):4.688826899096205
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:FsS7U7RPX1C2TycfBwGFTbeSTZ46931lBVZpjqAy3FGVs4yYiir/AMxkEb:FsS7U791C2TzpwGFTbNZ46d1lBVZ5qAJ
                                                                                                                                                              MD5:114CC594FAB2E564CCB24A826F3623E4
                                                                                                                                                              SHA1:C3C3FB4EF6EA6FF0E7A1E0289320B2FD2788B03B
                                                                                                                                                              SHA-256:C89E223A42D7173F915DD088EBC84B0048CEC772BD4221B4B90CE4C0E419FFE6
                                                                                                                                                              SHA-512:9A7EB5710340CECB2D32DE26322DC862812E185B6D260D76C0C7F642F30CF9E43C88AEC76B515148EF986DB0C77FD0E31F71C8FD26D56A4CC72DFF0D023ABB5D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L..../.e...........!......................... .......................................:....@.............................D....0..(....@...w..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....w...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_id.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):44528
                                                                                                                                                              Entropy (8bit):4.6434847290831796
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FaVkiL3THRxVkAHqIaHQRf2I95yrUZ2XIYiifkg4AM+o/8E9VF0Ny7:F76fqgpYii14AMxkE
                                                                                                                                                              MD5:7E7DEEF6AC35C9D52410FC356391C7E4
                                                                                                                                                              SHA1:43B3D918867A93BA109A3E4EACB45F3CD5C40B93
                                                                                                                                                              SHA-256:963F4D2AD7DDCDCFB6185521C0590A92F2014897D5F5F525471AC81F3807FC5E
                                                                                                                                                              SHA-512:9EB0E9BE0A973693B4BD167F6C1118DD9D702B1951A90F0A3A6103E77C43EE6AFA173B79D3AB21FE94A98C320B17AB0B787CF5B6EC47D9DDE9E3E8C14B8CADC7
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L..../.e...........!.........|............... ............................................@.............................D....0..(....@...r..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....r...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_is.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45040
                                                                                                                                                              Entropy (8bit):4.660150671701988
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:FN66ibAIibkUVQF5UefV32Yii27AMxkEr:FN66ibAIibkUVurfVG7dx
                                                                                                                                                              MD5:DAE35FA037B6248876347521C5298566
                                                                                                                                                              SHA1:8358FC05A675EA56F720052FBB4B384D97B94D86
                                                                                                                                                              SHA-256:CE0652B8DFAF21B6192B66BF75E140B3D72AA545E0EDF62D9E82E9B0878AC5C5
                                                                                                                                                              SHA-512:4158B8FEF0DA76EAD12B5D6E421C5709664BA84D1DDDE44EF6BBD1023084CAD3820A37ABEA03B206635A945A2435B301234CF5BAC3C8E2861A852B2699036ADE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....0.e...........!.........~............... ......................................L.....@.............................D....0..(....@...t..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....t...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_it.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46576
                                                                                                                                                              Entropy (8bit):4.63382318455147
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FAebzeIN+sah32RdnIYiif1p6bAM+o/8E9VF0NyfDh:FzCIN+P3kaYiimbAMxkEh
                                                                                                                                                              MD5:3AE3106694098F8420B182AD5E3354AB
                                                                                                                                                              SHA1:BC9DAB621B03D4126B97C260BECD7F4525255462
                                                                                                                                                              SHA-256:59B406B29538C3C3D0F060B5FC0CCD36556F8A6278327935A5475C6B21741DC9
                                                                                                                                                              SHA-512:F3625BE57976083D642B01A41A53D6DB6CAD3BFC584A50DE3565FE10975A5D7D2CF4F8B41BCDAA5AC70F8FC4ADA113084DE07E2ED45F26401DC2D4F8F4C322A9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....0.e...........!......................... ......................................8.....@.............................D....0..(....@..Pz..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Pz...@...|..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_iw.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):42448
                                                                                                                                                              Entropy (8bit):4.853168372285248
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FwTGNv7hdVexaDyQa/f8ssIwVqIYiifNrAM+o/8E9VF0NyID:FFRNMrVEYiitAMxkE8
                                                                                                                                                              MD5:31227325C8617B308CCD268C2BE7E72A
                                                                                                                                                              SHA1:71E369F26E644E643FCD538D933E4087DD593F1F
                                                                                                                                                              SHA-256:4A98E34A528EFF04C2BAF4E9E50489086E58D2E32E1851F33674ABBE5E104C68
                                                                                                                                                              SHA-512:BA8D94DDE5B7B74A39ED54A5F3E47A558E0C1DEB632018C82423C06806071143851BB1D8C7A7BADA6F13E71734E7A29457F3741266972B777CDED41C953A9645
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...(0.e...........!.........t............... ............................................@.............................D....0..(....@..8k..........Hz...+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...8k...@...l..................@..@.reloc.. ............x..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ja.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41424
                                                                                                                                                              Entropy (8bit):4.886245004030595
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:Fdy7PEHjkgWYvNSLIYiifHAAM+o/8E9VF0NyOFg:FKPEDkgWIYiiIAMxkEk
                                                                                                                                                              MD5:0CFC5B7B3F86D6BFAEC9A0713DA74DF3
                                                                                                                                                              SHA1:81A278FDEE9EDC302FE4E7A88C9ADDB230CE6DF2
                                                                                                                                                              SHA-256:1D7FD1B6A614538530385E7A40EFC95D3B8BE75057AE03BF999AA2419D1F9F24
                                                                                                                                                              SHA-512:8B8F834CCEE41C69C581F0B80F26B0CDB536F87BEBD5A6B1F02CDF6F1AEA5CF5B29C356E82C7A8FD591BB16C0938A790AC8F90F6D27EDC95FC48A5AA3C30CBF0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...70.e...........!.........p............... ......................................q.....@.............................D....0..(....@..xf..........Hv...+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...xf...@...h..................@..@.reloc.. ............t..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_kn.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46576
                                                                                                                                                              Entropy (8bit):4.956816308571518
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FirqrE8RBST3JecIYiifA39t2AM+o/8E9VF0NyGE:FbrEwkUNYiimeAMxkEF
                                                                                                                                                              MD5:49000B4A101E635B05123F21B360B492
                                                                                                                                                              SHA1:635F697F41C0591168E0EEE10930728D9DEC5A53
                                                                                                                                                              SHA-256:A2AAB58A4397C040BFF69D45BEF4EDE6842034BF897799A9347232C4B6C9C7A5
                                                                                                                                                              SHA-512:9B62C2048E9C132089CCE7DA02EA5C95B5856F1C6E28D5581F4A0B1748E681BDD78C7D537D273A64F9D476E4EC62DA5C6021CC1CCB69F7BEE216E7BEC6DDC6E0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...F0.e...........!......................... .......................................M....@.............................D....0..(....@..P{..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...P{...@...|..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ko.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):40912
                                                                                                                                                              Entropy (8bit):4.906775411499508
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FnVErHzd4IY+N1vZsYoRHgA12MrlxB4xRkkTY1M5tkONMsIYiif/GIDdAM+o/8Ev:FarH2mAq/jv2YiiPAMxkE
                                                                                                                                                              MD5:DD2F783C0017630F9A2969957F4EB84E
                                                                                                                                                              SHA1:D42218DE12A7C1C48FB5E7D60E61E32CE0CD9AC6
                                                                                                                                                              SHA-256:07E63E0E3D23F192AC131EFC459C2D9F79A4ECDC39403D43FBFF320C4B5FA261
                                                                                                                                                              SHA-512:689F625DF8AEC45A6343249739EC094CBB1245A9DD8847FFE6BF62FD2D7042D529F77216DD22E8B33830CF21B158F0EF6EA42AF2248051C8D97205EB0229A22B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...U0.e...........!.........n............... ............................................@.............................D....0..(....@..(d..........Ht...+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...(d...@...f..................@..@.reloc.. ............r..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_lt.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):44528
                                                                                                                                                              Entropy (8bit):4.677924498339083
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FUAcI3nc9eHz0CwTF1B+jF2XI1PKLIYiifp+GAM+o/8E9VF0Nya:Fi2ckHz05TF1YjF3RYiioGAMxkE
                                                                                                                                                              MD5:38606BFB6C9BFDF74503F833EE2733E5
                                                                                                                                                              SHA1:670ABD1279F642EC7B19F663E53F2813A716331F
                                                                                                                                                              SHA-256:DF6C4228DA3BF66929D81B99CB35DF4A4389418490144630E1D9D5F422B56B38
                                                                                                                                                              SHA-512:6CC6F2FB0E5BF0241656CCE5DC7311F05B8D79633F2176F8C172A9FCFA9813E3963576363D539FA1A8A58FA6BBA138DD0BAA7562274FBE99BE5CDA60F4671747
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...d0.e...........!.........|............... ......................................'.....@.............................D....0..(....@...r..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....r...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_lv.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45552
                                                                                                                                                              Entropy (8bit):4.703638320348715
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:Fm+weS5yAxOeKdeVHAtIYiifX0AM+o/8E9VF0NyuOT:Frzgf1YiicAMxkEr
                                                                                                                                                              MD5:83C356F6310D51F8FFC1D67D580F5914
                                                                                                                                                              SHA1:F9BC318975F288FA47E8426B4C450A93B10AF45C
                                                                                                                                                              SHA-256:98E35CEA7CDDCE15191594A70F8E15FF2DD1C02BDE87225AF0331441C65BCA26
                                                                                                                                                              SHA-512:28A26CB1D88D072D7898ED27C3E9D056EFEDAA2CD9ECCF951429F41DF2C0162BE3C14E58CFB4CF50B633D759825FA815A9249E7690D2AB75F60424B30DBE0424
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...r0.e...........!......................... .......................................5....@.............................D....0..(....@...w..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....w...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ml.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):48152
                                                                                                                                                              Entropy (8bit):4.926265622213845
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FY1ZCwBLFZygd8/JLT1nqIYiiffHUxAM+o/8E9VF0Nyu5:F6CUSJLtYiiHyAMxkE
                                                                                                                                                              MD5:74E24332295807CA5AB8BE9F37DD19DC
                                                                                                                                                              SHA1:82FEEE443E0C8342EF830C182FC2A3C98F57FAF7
                                                                                                                                                              SHA-256:4675474B7CCAF45C9FCA9C4D141260F233807DDC68CF854D0900BB1F58522B67
                                                                                                                                                              SHA-512:6682D18ED66B06F07BB6B1DC227808D5C872685ED271FF4B34A57D4EC7C7FE5316B6207D1094327DB4E3166FC2288E47065CB72A275666A4B403DDE8E33379AF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....0.e...........!......................... ......................................,|....@.............................D....0..(....@..0...........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...0....@......................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_mr.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46064
                                                                                                                                                              Entropy (8bit):4.8976075699187085
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FlFabd4/7JK7bABYRbUvIYiifxspAM+o/8E9VF0NyUi:FCp4/7JK7b9TYii+AMxkEl
                                                                                                                                                              MD5:390C8645CB5E0F93054C063C5E5928F4
                                                                                                                                                              SHA1:0D17AC3976B3219750853715C06BAA34E8ED751C
                                                                                                                                                              SHA-256:98AE5DA68F38DD4E43E307543D3218D4180C09433AE72C3B661EB73591A7A589
                                                                                                                                                              SHA-512:B1BF09A5111890FA61DD944DBF0CF2804CDD96C5FEE3193A80FB15CDC6FDB455FB4E535E8AEC337CA4595623BEF29C7F6784E53E222C7A5DF400DC61965830F6
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....0.e...........!......................... ......................................2.....@.............................D....0..(....@..Hy..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Hy...@...z..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ms.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):44528
                                                                                                                                                              Entropy (8bit):4.650804344909199
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FcCT3TCrQLtUv6oNpaAYjZZ/fbMgTRlREm5IpIYiifyoAM+o/8E9VF0Nykg:Fns+f3TFzYiiHAMxkE
                                                                                                                                                              MD5:D9999C911F60A32046D1A4C559AE5DE3
                                                                                                                                                              SHA1:E84C1C32708A97A81358DD8ADB3FB40681F5A7AA
                                                                                                                                                              SHA-256:31A64FF7F0B1D8BB81E83680C3391C0DC5530C798B9322D11E62E2389933B548
                                                                                                                                                              SHA-512:EEFB62C906C85A94025D79A0DD35B634A08B457FCA57E2B97D514F1B5F0B9EA8450C9D387B4D9683C5D01D0088E03FD106B530470AA88229AB4123EDF00032AA
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....0.e...........!.........|............... ............................................@.............................D....0..(....@..hs..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...hs...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_nl.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46064
                                                                                                                                                              Entropy (8bit):4.642435256245184
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FOSZaiXd/T32w1o/sIYiifUvAM+o/8E9VF0NyrWF:FgitKoUYiiYAMxkEA
                                                                                                                                                              MD5:CCADD45844090D479F00D8707E962F35
                                                                                                                                                              SHA1:0654501881968CB2D954CB95DA6150047C49C0C7
                                                                                                                                                              SHA-256:854804CB86A3059BEC32D10F44123FF93060AAE05EAA72821148A4E2764ACE3E
                                                                                                                                                              SHA-512:098A384BAF41A11A6E50B2D22E1C1E1CB2D9F5897776AFA676B235F075C9ED3F404A92D4593C229E6EDEDAB4DA614B25E5CD0C73F3CB7E0AC02231CCE800F7A4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....0.e...........!......................... ......................................V.....@.............................D....0..(....@...x..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....x...@...z..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_no.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45040
                                                                                                                                                              Entropy (8bit):4.662201606247274
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:Fgg75JZSiyCSiypVVXAYSTv4q6K3QtCNrIYiifUjAM+o/8E9VF0NyXk:FUVVwYWv6K3QFYii6AMxkE
                                                                                                                                                              MD5:5A19716AC62F7B636D666BA166D00A3E
                                                                                                                                                              SHA1:0FA31113684F879E259F8521BE08FF87286724E4
                                                                                                                                                              SHA-256:94365146AE8320732DAD96344DCF6FA83D9EAF65CB7BF30E50613964F5A33E66
                                                                                                                                                              SHA-512:ACCFBFD86C4648FFF856FAFFFBE7317907E19261ED81CE5E6CD9E5AD59AE9ABBE677730527704A1B0BA898195DCC6A5081A136B4D95563863F05A8EB9FBAF9FC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....0.e...........!.........~............... ............................................@.............................D....0..(....@..Hu..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Hu...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_pl.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45552
                                                                                                                                                              Entropy (8bit):4.7016134614469465
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:F10/L7n7KZHCCN08Gp6o1HnIYiifPH7AM+o/8E9VF0NyT9J:FO/y3+ywoYii37AMxkEZ
                                                                                                                                                              MD5:5215164235C7DC3D72BCD0F832DDCD22
                                                                                                                                                              SHA1:BDE57F57953BF119B6767E0B56380DBF0E4CAD35
                                                                                                                                                              SHA-256:C997F4BAD6082C5D2483684B6A72D22153C502DF6575E28CC1BF02789D08547B
                                                                                                                                                              SHA-512:721423EA189D096764088FD8079988CBBCD98503AE2B82B0F485CB71BC81CB367588A9FCBDC9C5D09F20067F5EC8744572D252500AF034EDF900243E096526C3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....0.e...........!......................... ......................................6.....@.............................D....0..(....@.. w..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc... w...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_pt-BR.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45040
                                                                                                                                                              Entropy (8bit):4.66806219304549
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FkqLoZc+GZX8O1EsAIYiifXMrAM+o/8E9VF0NyuN:FLmFyXYiiwAMxkE
                                                                                                                                                              MD5:97C200CBD682C1B4BD28222437D7F630
                                                                                                                                                              SHA1:6BED6312571EA79DF6DEDA2934D328683674B059
                                                                                                                                                              SHA-256:3ADC3BD14D6A1AE14DE42EA501FA74ED651B197A7C8912B43D31FA92F500D630
                                                                                                                                                              SHA-512:8E1AF6B73729F5F6E3015C3890E8AD28ED851D1615FE0AE2B7997F3AE48958FBC90E74CE70CE4EF35AEEA35A810DE0699494D5B913F4774416ACC1AA8EF0A9D6
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....0.e...........!.........~............... ......................................M.....@.............................G....0..(....@...u..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_pt-PT.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45552
                                                                                                                                                              Entropy (8bit):4.647566471839956
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:F2eyzstFNEx6ewBf1/UBIYiifT2AM+o/8E9VF0NyKGP:F8IMx/U9vYiiiAMxkE
                                                                                                                                                              MD5:D30B159A64D1698CFC29D336B26DD922
                                                                                                                                                              SHA1:CB22D98F4F03C718B7588FE7D61469B53B3F5488
                                                                                                                                                              SHA-256:5436A04ED13F635E820C748D10EFD86B94931B689F5AC834FCF7D6081D0AAB4E
                                                                                                                                                              SHA-512:448F9B2DFF2FB48F31D5D7953B4DDF347369ADE4B08AF9C8CCB337DE5E7D14B8B49E5C436D785A3A0DF00E41289AD29E0581840AD8A00653D290EE9C121BB691
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....0.e...........!......................... ............................................@.............................G....0..(....@...v..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....v...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ro.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45552
                                                                                                                                                              Entropy (8bit):4.669510664963654
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:FxcDC1yNbMUB251BRHc871nDtCuUYiifAMxkEG:Fxc6BRHnRDVU7ax
                                                                                                                                                              MD5:9D85D4410FBC05AD19686079129BB0D4
                                                                                                                                                              SHA1:8B21633A2190AEBDA899D7902E130CF4C035DE66
                                                                                                                                                              SHA-256:B0745258F9B3EA6F011B2ED61D61312A9636D5CC8706D525D403FDAB5FF5B46A
                                                                                                                                                              SHA-512:636F997817EDC9531FEA2BF7327A78203626EE8B30B2024905F9F4F88B121A325471C2C16E691A590713A09C040CEB0F9BA9F468784C959A2318B9626B59A247
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....0.e...........!......................... ......................................).....@.............................D....0..(....@...w..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....w...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ru.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):44528
                                                                                                                                                              Entropy (8bit):4.872218382175696
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FpK6JF44vKAvHdho4d2lw1iqIYiifY3XAM+o/8E9VF0NyI:FTdvHsloIYiicAMxkE
                                                                                                                                                              MD5:5C7F5208991B9F8EC135A8BB06E805E6
                                                                                                                                                              SHA1:5AB93B5EFCAC3A7D0B6E17CC1D32521E92388D2E
                                                                                                                                                              SHA-256:776084A71292C1402B439AD1D4F0414BC196EFE453C338E42944D4BFF6816817
                                                                                                                                                              SHA-512:12F9F541BA0CAB26B414CCF8099337A6A730FB8693F1F7BC30B5254ACC2C883DCCBDAC1B4F243218DFE5C41B3059E1A3C877C0C14E872609029B071C8A1E27A0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....1.e...........!.........|............... ......................................H.....@.............................D....0..(....@..ps..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...ps...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_sk.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45040
                                                                                                                                                              Entropy (8bit):4.699382433415797
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FUqXI8uh+PiR6gLT93JOIYiifK0yiAM+o/8E9VF0Ny8:FLejRjpJYii4iAMxkE
                                                                                                                                                              MD5:C89B0C8C3B91985EA2E215667F7FE79D
                                                                                                                                                              SHA1:3D646B06B540A12E9B4E1E3C44DA70334875E0E9
                                                                                                                                                              SHA-256:6E139010616388B1794F6C5D88835AC963AE60D53A509CE54F5AA994A35CB292
                                                                                                                                                              SHA-512:C050748256998D0361FB02E5D9797B957917B20669A4308A3A3E0F54946060FF7CC39FDE71D8BF7BB2AF12058075E6156E6EEABD2050B65DC3C8E3D9217F1E25
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....1.e...........!.........~............... ......................................0a....@.............................D....0..(....@...u..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_sl.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45552
                                                                                                                                                              Entropy (8bit):4.659294505999352
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:Fmu/ITsshVyixlk5TpWBdf1i2IXousGuFAIYiifeNsAM+o/8E9VF0NyvH:Fh74lk5y1YZs1YiiNAMxkE9
                                                                                                                                                              MD5:D35230F93F12E95AD99C10D39DEC016A
                                                                                                                                                              SHA1:C303793C2EE4B9995862D7FFEBC78F966344843D
                                                                                                                                                              SHA-256:85813F97EE64C8633D3CEEFC0FA13F1DE021EB6911195C72FAB2C9B95496CDC7
                                                                                                                                                              SHA-512:78E39BDA68E28963D0C4DF8D24C0B4C56BFD2666FC02E7952916CB9F98724C3D758CAAF99AEE6E936461A9A685437327F10A543CB457E562FE70FE557665B589
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....1.e...........!......................... ............................................@.............................D....0..(....@..hv..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...hv...@...x..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_sr.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45040
                                                                                                                                                              Entropy (8bit):4.86697870674738
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FauhcB7ixHUjY13tGUyJDqIYiif+ujAM+o/8E9VF0NyH:FPc6UjudG/XYiinAMxkE
                                                                                                                                                              MD5:F8709246B0E8F490CF9D02D2CCEA3DA6
                                                                                                                                                              SHA1:3909C4AA86D47C799E5DF03556C5D39EEC254850
                                                                                                                                                              SHA-256:7CFE886DD1FBBE9F3CEA93D547E88893F30471B3866BA16357CEB29F47E8916A
                                                                                                                                                              SHA-512:1BA16AF0AA64A64AA1FBF0C487E467D1432DBD8048801590BCA9C9AE0A935F1DF952068B6AD6D10E1D02714570141DAFA5A021B50FEE6FF597F65EA03398A249
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...)1.e...........!.........~............... ............................................@.............................D....0..(....@..Pu..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Pu...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_sv.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45040
                                                                                                                                                              Entropy (8bit):4.667264057142065
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:Fb4MMxC7vc3ET1f8sIYiifwuw+AM+o/8E9VF0Nykb:F9MxCDc3Eh+YiiJPAMxkEe
                                                                                                                                                              MD5:B8D8D9B17CC97212360C25E681100F53
                                                                                                                                                              SHA1:6BC19BDFB2B3C654DD7F046D76FB40A67B852D42
                                                                                                                                                              SHA-256:F26DB77619F6971C9BC93818A4C09B1F0AC2EB8DD3750750F7A5687D3DC6821E
                                                                                                                                                              SHA-512:B409CF8540DDCDCFF78CCF80819FA6C77BEC5DFEA07C4A7FA260F6C6363B932386C0F1B5C4BDCC317FE2DF3839EB58A0E69196B2A68D70915081EBC983CFB8B7
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...61.e...........!.........~............... ............................................@.............................D....0..(....@...u..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_sw.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46576
                                                                                                                                                              Entropy (8bit):4.69554904846272
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:Fvld8gicgiY7upv4M5FwbIYiifaGEAM+o/8E9VF0NyO9:FD8Q07Gv4M5vYiidEAMxkEM
                                                                                                                                                              MD5:2BEBACB8BBCF1AB8BF0C8D99D5F023A8
                                                                                                                                                              SHA1:FA6BBA3E1302E68DB673490595C5206CCBE278BE
                                                                                                                                                              SHA-256:71B1892D0A58FDA202B93BEE5E25DA3A33091A728551870EBB09003AA0178CC9
                                                                                                                                                              SHA-512:5C7751FB54531C06B26846807E3552C150CFF737096166C627E66BEE87CF1DC0BC4E5F245E4BA26660A0D0AAD0708BCD09C7F8334504DCE35552DD62F774F441
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...B1.e...........!......................... .......................................C....@.............................D....0..(....@...z..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....z...@...|..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ta.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):47088
                                                                                                                                                              Entropy (8bit):4.945882549056105
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FUSEFwsY51ZLm+4LwXdwIYiifqFnAM+o/8E9VF0NyaX:FYFXY51ZLm+4LwnYii8nAMxkE
                                                                                                                                                              MD5:100F983BFBE3DD304E3460D0D763A5A0
                                                                                                                                                              SHA1:554A6AD7F279D88DE4BEB0D110F08EB1F6079A40
                                                                                                                                                              SHA-256:71CB104A5A65A2217046BA791AADF6D92D26FED572B8BAB426F1977DCD13EE84
                                                                                                                                                              SHA-512:46FDBED864D098654CC804819BFA193D0ECD5D1CB206AB558E3EAD53AA01A8A7A4BF30A493FE51C861EEF630D20F697C880D90DB87E54F4063EF3B8BD3782002
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...O1.e...........!......................... ............................................@.............................D....0..(....@...|..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....|...@...~..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_te.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46576
                                                                                                                                                              Entropy (8bit):4.897604155898617
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:Ft+0Dqw45Z4aJALDoGoIYiifeWUnAM+o/8E9VF0Ny4:FhDqd5yaaLDZYiiG7AMxkE
                                                                                                                                                              MD5:09F080D9B57532AD375924C8B79AA863
                                                                                                                                                              SHA1:7C3589D33CE76C61E9078A38B843C52E9ABB5098
                                                                                                                                                              SHA-256:866001CF685E35F808B626ADD94F8DC1AA6CCC3F7F93622E4F1749E8276DF8AF
                                                                                                                                                              SHA-512:F6C33D74E095C1BABD14237D61230203CBBFC1675ACEFD32B7905D563F2321C55C26CBB0CC05C6FF2EA5816D23220E510F6D5B7916FE0BA314F3C0D9AFB21779
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...\1.e...........!......................... ............................................@.............................D....0..(....@..@z..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...@z...@...|..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_th.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):44016
                                                                                                                                                              Entropy (8bit):4.900742032907252
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FBRlAlrGsMKNMAcetNF1BHrgIYiifnl6JIAM+o/8E9VF0Nyxq:FdAlrGszNMJetNXBLpYii1AMxkE
                                                                                                                                                              MD5:07DB9EC1C345BE55F5124BE7B5C2D0DA
                                                                                                                                                              SHA1:BFB3409AC023DBBA2532F57AEC2AA22097B452B9
                                                                                                                                                              SHA-256:57A70C0CCB809BB7D4AD6AC611BF99266AE50BADAF0EE12D145080E79B1BCB29
                                                                                                                                                              SHA-512:8E9C0800A70DDD2868C7866F0DA5EDDD90EA014228B92B186E97131FEAF534C1477C902995D03F40D2D7661387F007FBED6E5B88A3324D5F770F6A80BBD05D78
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...h1.e...........!.........z............... .......................................]....@.............................D....0..(....@...p..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....p...@...r..................@..@.reloc.. ............~..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_tr.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45040
                                                                                                                                                              Entropy (8bit):4.7104907521422525
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:Fy1p9ABk6qXQEdmvgh57GE+G9Ahrx++BzQSXBdYiiJUAMxkE:Fy1Zhdmva7GESxLQKBd7ayx
                                                                                                                                                              MD5:A2408056E2891786989AE7089B03F045
                                                                                                                                                              SHA1:FB65851E2D17A85CDBCF86EDEF757C1DB9734216
                                                                                                                                                              SHA-256:9E3C6F396605850CB66B09870FDB346F64BA19001FB04BF416B504A5FBD572EF
                                                                                                                                                              SHA-512:04C1136638B4F99ADC0A46760843F0BBA502D4ED3D715B42D90B3CAF0FB49CC4B878590BFDBC7FBBFB71C0EC9AABF4250C375D4977E7C722B8F283ADAF902C13
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L...t1.e...........!.........~............... ......................................|h....@.............................D....0..(....@...u..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_uk.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):44528
                                                                                                                                                              Entropy (8bit):4.886178525177006
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FCNlWEKgHWyC2EeEWNXE/Gfua1ioIYiifNjAM+o/8E9VF0Nyy/:FOWElu+SYiiJAMxkE
                                                                                                                                                              MD5:F13699D054B4A5C7F7555BDF42DC2B2E
                                                                                                                                                              SHA1:899D230BF0E4DBF51B552288B7A65FAEFDEC15E1
                                                                                                                                                              SHA-256:585B4E9581E4531445A41676C87822A8F721E384A5A9DDDC17642B39BD983E7F
                                                                                                                                                              SHA-512:DEDB6E3DA8025B45D1D7A87FC9235DC156C4E5E322DEDBBF8ED8C3A4E719BD6D9232E836C7BA0D14E93FE70728195BB8213682A324B3765B868B9780269130A9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....1.e...........!.........|............... ......................................>{....@.............................D....0..(....@...s..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....s...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_ur.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45040
                                                                                                                                                              Entropy (8bit):4.853180692090808
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:FhZ8Q+OmAcoWAOeesY2f2YiilJAMxkEnh:Fhp27wRxb
                                                                                                                                                              MD5:440107FFDC419C31118E13311DD07092
                                                                                                                                                              SHA1:E19CD50AA757D6806A295C18A9EF52F92E85F124
                                                                                                                                                              SHA-256:FCC94C5D16A4FB8C3BDB191E9CF1FD2B60A780C8E7C247F1B513B2DAE7A51AF9
                                                                                                                                                              SHA-512:20F150D0B4FA888202FCBE0C1249F81579A81BBF41EA2F64E44DD03A10E55B504664058CACE169C122260F9EBF30E143F75A92C54877F3B2098E84E3C699B21C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....1.e...........!.........~............... .......................................!....@.............................D....0..(....@...t..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....t...@...v..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_vi.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):44528
                                                                                                                                                              Entropy (8bit):4.7736357938320655
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FtoX9fhFjnco1m6rIYiiftYPFAM+o/8E9VF0NyT/gW:FI9fhVcw+YiiKdAMxkE
                                                                                                                                                              MD5:2390C3C4DDFA136A23575187550C7612
                                                                                                                                                              SHA1:DD539EC73E7E9C706CA2EA305CBA1F9C8B3AE257
                                                                                                                                                              SHA-256:88499F0E0D5E4F3C34C020DFA672F7F16992290CC624A4B086C1AC5357FA214B
                                                                                                                                                              SHA-512:29C327B44A1EAE93196BFB2C65F4246B7343DE00921BEEE641B53499622998C73E356D20E454DF7C2D68D5B54334E423E64A27D31B537BB5B5B315AD3C218E24
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....1.e...........!.........|............... ............................................@.............................D....0..(....@...s..........H....+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....s...@...t..................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_zh-CN.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):38824
                                                                                                                                                              Entropy (8bit):4.841360671519499
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FHa/65shAFB3fcdIYiifS6AM+o/8E9VF0Ny7o:FIRAFBLYii1AMxkEK
                                                                                                                                                              MD5:30FF48252DA52C816EDE2E88B9E03D6A
                                                                                                                                                              SHA1:07D16CBEF6F0042173A783D91F5DD8FDAAD4C399
                                                                                                                                                              SHA-256:F53A4AE21D6B6D92A38D53752CB3A8375778A8F06E8E3D934C37FB3454925C52
                                                                                                                                                              SHA-512:48A50815A0E9111CF144514362C9E6E68F7E7C123270A25A5A44ED8C2AC58652A9DE0740593698E4AC55703FE94D6C14C74B52DA6757253288B8A3DB5F9F2129
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....1.e...........!.........f............... ......................................u.....@.............................G....0..(....@..X]..........Hl..`+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...X]...@...^..................@..@.reloc.. ............j..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\goopdateres_zh-TW.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):38824
                                                                                                                                                              Entropy (8bit):4.856840920839133
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FMozg9GmewVCIYiifF5fcAM+o/8E9VF0NyjjU:FFQzYiiMAMxkExo
                                                                                                                                                              MD5:49BC03FDD21621E636F35AC544F6E002
                                                                                                                                                              SHA1:BD55D8B28EBF714A22B57A671A838967B2B166A5
                                                                                                                                                              SHA-256:C2F447C5B563A081AEF0F73BD7835927C6A8869D2B57888D7499F0738C31459A
                                                                                                                                                              SHA-512:ADC2D172D554C0455CF81BAB3F107F3B138B5C132DF4A4951234F911F5AEAC77F7014F83A8BCB2209FE1111946AC30EE2B703D80AE6B14BEE9C5A95E248C7174
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q/.A.A.A.A.A.A..eE.D.A..`@.B.A.A.@.G.A..eH.@.A..eA.@.A..e..@.A..eC.@.A.RichA.A.........PE..L....1.e...........!.........f............... ......................................w.....@.............................G....0..(....@...]..........Hl..`+...... .......T...........................`...@............0...............................text............................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....]...@...^..................@..@.reloc.. ............j..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\npAvgBrowserUpdate3.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):519160
                                                                                                                                                              Entropy (8bit):6.796736322809112
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:ar+V/qwxl3kPrQ2jU9F0A3oiSdTP4iw/I:C+V/9xlwjUYVddTgiw
                                                                                                                                                              MD5:C6A2BFF8E96B5622BF6841A671F4E564
                                                                                                                                                              SHA1:FB638E9C72604CC1B160385FA803B0EA028E5D5E
                                                                                                                                                              SHA-256:7A7A12E9C0DEE713700081B9354647972A0F3505596DF34E4C68AABA99046992
                                                                                                                                                              SHA-512:22A99F860055388E34A056AF5D5E35F2E33A9294784795ACA52FD42685D75AEBB523ADD836C5E4B9B2F68FE00348D11EE56CC10208FCC662B86A6169664F934F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........iI..'...'...'..}"...'.rx ...'.rx!...'.rx$...'.rx".Z.'..T...'..}#...'..}$...'..}"...'.rx#...'.rx&...'...&...'..}....'..}'...'..}...'..}%...'.Rich..'.........................PE..L...d,.e...........!....."..........[........@............................... ............@..........................;.......<..........P...........H....;......DI...%..T....................'......(&..@............@...............................text.... .......".................. ..`.rdata.......@.......&..............@..@.data....H...`.......8..............@....rsrc...P............J..............@..@.reloc..DI.......J...f..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\psmachine.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):396224
                                                                                                                                                              Entropy (8bit):6.6361079440133315
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6144:64zNJdcJ1OBrpGdYoq+ybZ4rYICzOHz25HzPCJKwAOer0wUl4rgOdr:lNDcJ1645ybZ4rYICzChs0/0Lr
                                                                                                                                                              MD5:E105363EA90F281E16D3166A5604048C
                                                                                                                                                              SHA1:9FD0DE31161CDE1C74132B33EF1F81A9320A73FD
                                                                                                                                                              SHA-256:FA1676CD10754717FDD8B92DC5660E621CD9F9E1F056CED548723B6C5BD98355
                                                                                                                                                              SHA-512:E70DF3E9CDD01C9A16D5748296B0577A18204EE7630D855A312B6FB833847ECE2697996CF2AC5317D4D8519D84EC0C7180F760B0F38FB42F8952CD76CBA2F973
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........IB..(,T.(,T.(,T.X/U.(,T.X)U@(,T.](U.(,T.]/U.(,T.])U.(,T.X(U.(,T.X-U.(,T.(-T)),T.]%U.(,T.],U.(,T.].T.(,T.(.T.(,T.].U.(,TRich.(,T................PE..L...C..e...........!.........................................................0............@..........................3.......3...........V..........H...x7......L5......T...........................0...@............................................text............................... ..`.orpc...c........................... ..`.rdata...X.......Z..................@..@.data....4...P.......,..............@....rsrc....V.......X...F..............@..@.reloc..L5.......6..................@..B................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\psmachine_64.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):521280
                                                                                                                                                              Entropy (8bit):6.356837749790641
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:tTfHJFKFK/IMakxvvCFjE0T1oM40MEXd:tTxekoFjE0hE0M
                                                                                                                                                              MD5:0636B267BDCBC3F0DEC2A7223220A5F7
                                                                                                                                                              SHA1:5A9CCC93B7076008E3DEE777F593E7D13B566386
                                                                                                                                                              SHA-256:E1933E8EA4FA969C52ED1306FD4065B4B6F0E236F582D8C3CEE69DCD087CEE4D
                                                                                                                                                              SHA-512:509F5F54322208179DFF56B238974C3346AE962CE927C54A4326FE541444ACD0DD66E9C43D142AE4D592F5CCC4599E07DAB8E50664E044F242F0ADA8B3C359DC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-..i...i...i.....b........;..y...;..c...;..$.....q.....v...i......1..W...1..h...1.V.h...i.>.h...1..h...Richi...........................PE..d...Z..e.........." ................(........................................0......2'....`..............................................................V...`...9..H....;......(.......T.......................(... ...8............0...............................text............................... ..`.orpc...$.... ...................... ..`.rdata.......0......................@..@.data....N.......&..................@....pdata...9...`...:..................@..@_RDATA...............H..............@..@.rsrc....V.......X...J..............@..@.reloc..(...........................@..B........................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\psuser.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):396224
                                                                                                                                                              Entropy (8bit):6.635408355334313
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6144:84zNJdcJ1OBrpGdYoq+yDZ4rYICzOHz25HzPCJK+AOAr0Q8l4zgOdr:DNDcJ1645yDZ4rYICzCPC0HcLr
                                                                                                                                                              MD5:334E1A8A1AD36AFEB01CD518ACB0A169
                                                                                                                                                              SHA1:92F743D1B1AA9FE90572DFACD5C9E951C873BDB5
                                                                                                                                                              SHA-256:53EA8B812A6E95B065B81AC09AC66C2A9A92C01FBB9FF7FA80745C54E3E1084F
                                                                                                                                                              SHA-512:E192D16E6BE355687B332008348FAA58B04BA167758301F01F4AD9DA3A4B2B2B79F0833D7BC14021C818677A3516E005988AC478EBA4D5CFF27C784E01CBB373
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........IB..(,T.(,T.(,T.X/U.(,T.X)U@(,T.](U.(,T.]/U.(,T.])U.(,T.X(U.(,T.X-U.(,T.(-T)),T.]%U.(,T.],U.(,T.].T.(,T.(.T.(,T.].U.(,TRich.(,T................PE..L...o..e...........!.........................................................0.......j....@..........................3.......3...........V..........H...x7......L5......T...........................0...@............................................text............................... ..`.orpc...c........................... ..`.rdata...X.......Z..................@..@.data....4...P.......,..............@....rsrc....V.......X...F..............@..@.reloc..L5.......6..................@..B................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUMA6B.tmp\psuser_64.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):521280
                                                                                                                                                              Entropy (8bit):6.35654089402388
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6144:CMI/T3wuTTHJFIogFK/IMakdbv4aU5iWM1uEn0T1ohLWMV450dWE9e0l4uJV:6TfHJFKFK/IMakxvvCFjE0T1oF80MEn
                                                                                                                                                              MD5:6FC24C326EBAC1247427537D237B4ED9
                                                                                                                                                              SHA1:597CEEF4704DD4D61AA768EAC276BE02F24DFEC9
                                                                                                                                                              SHA-256:B428F332DF0E881437C78557A646A6A3E05F69072B3BD3A6343B23A3E84EDB0F
                                                                                                                                                              SHA-512:6C28A388A71D671331E9A861CE35F98B8AA47900DA37D072E13BE786C24DC5711F5776B630A7DB22F46414FC1E347659BC610B7A8EF06F39AD99F84810854113
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-..i...i...i.....b........;..y...;..c...;..$.....q.....v...i......1..W...1..h...1.V.h...i.>.h...1..h...Richi...........................PE..d......e.........." ................(........................................0......yA....`..............................................................V...`...9..H....;......(.......T.......................(... ...8............0...............................text............................... ..`.orpc...$.... ...................... ..`.rdata.......0......................@..@.data....N.......&..................@....pdata...9...`...:..................@..@_RDATA...............H..............@..@.rsrc....V.......X...J..............@..@.reloc..(...........................@..B........................................................................................................................................

                                                                                                                                                              C:\Program Files (x86)\GUTA6C.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              File Type:POSIX tar archive
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):9707520
                                                                                                                                                              Entropy (8bit):6.489388936612899
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:98304:Oao28P0tP3kVzHtjPIKFu0pHbwjU3vKLQP2AjdOZAcXUD0iRlIFREz1K4ri5EN1v:+P0Z3kVzHtjGMHT4ZerIfIcGP/G7y
                                                                                                                                                              MD5:AC5CF3F9DF776FA161FAE9400BF0F61D
                                                                                                                                                              SHA1:1114DEE2994312FBC987534D221094AAC6EA7CDA
                                                                                                                                                              SHA-256:BCD1A4D70DEF547CEFFF9D90F743437AFC20502B6208AC8045BDE0EF561A5ACB
                                                                                                                                                              SHA-512:D53F78E9D0F42F49A78EF8366C52F45070F8FB9EE7F50A831215F31555CA9F2B7735CD3EF076E413A8E6BD733D7A662CFA977F2672F560906B2A3E8369C2B10F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:././@PaxHeader......................................................................................0000000.0000000.0000000.00000000034.00000000000.011452. x....................................................................................................ustar.00................................................................0000000.0000000........................................................................................................................................................................28 mtime=1711024764.6444287.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files\AVG\Browser\AVGBrowserUninstall.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\ajF04F.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):6116200
                                                                                                                                                              Entropy (8bit):7.990490156580378
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:98304:A9Aqm4Riz+Hbw3PR/eqltg9yLcYGgtf2euoelboe2u+8zBfjjGMfLrmdxiW4KTmv:9qxRii7AoyLVG8XuoelbT2+bK2rmdADJ
                                                                                                                                                              MD5:ACB51434FD82EB460B052F05950B8DCA
                                                                                                                                                              SHA1:707D192DB2CE7CEFDEFCE3037DFB85A18B8811F3
                                                                                                                                                              SHA-256:29FFA251CB267969AF445EB664DF04D1A7BADBCADE61A7F754DE42B6D4340055
                                                                                                                                                              SHA-512:013DC0ABCC9760C6298B7E48007EB1AC4BC2E453F06C1CE4AFF218F50CD1E2C4BB44AD6BC5687EDB057DF8B0E38FA0AAADA7A8D045ED08412278D3031527229D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........18..PV..PV..PV.*_...PV..PW.MPV.*_...PV.sf..PV..VP..PV.Rich.PV.........PE..L......].................f...*.......5............@.................................Lf]...@..........................................................*].P)...........................................................................................text...{d.......f.................. ..`.rdata...............j..............@..@.data...X............~..............@....ndata...................................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files\AVG\Browser\Application\124.0.25069.209\Installer\secure.7z (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe
                                                                                                                                                              File Type:7-zip archive data, version 0.4
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):377630432
                                                                                                                                                              Entropy (8bit):6.946458986175724
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3145728:zZFDXIM0S8QQyc6p4rgb168aHcB3dzoJgkDH4D9wyvFM:TJt2c5uek06
                                                                                                                                                              MD5:E53CECA664C9C956F183C10990BCF248
                                                                                                                                                              SHA1:B59F00A971AA3C81913F6875D854189BB868F97E
                                                                                                                                                              SHA-256:4E7F911A145FE3719F60E27E821E247261B1591E879291315005150C73ED4F6F
                                                                                                                                                              SHA-512:ED168B05C6F9151FDD67A6526740E7A441BEB48FEA7CB8B8A5A8A5B4DE78D6DBC6FF944A5289CF7988A9B6FE6FD376588A800A1BB13400DE0942824E2791381E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:7z..'...R..V........&.........}<assembly.. xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <assemblyIdentity.. name='124.0.25069.209'.. version='124.0.25069.209'.. type='win32'/>.. <file name='chrome_elf.dll'/>..</assembly>..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v,............~......~S......~............~......~......~.......~.............~......~...................~...Rich...................PE..d...+..f.........." ...&............@5..............................................I.....`A........................................p...x......d...............L...H...p)...........o..............................`n..@............................................text............................... ..`.rdata..............................@..@.data...............................@....pdata..L...........................@..@_RDATA............................

                                                                                                                                                              C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe
                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3498000
                                                                                                                                                              Entropy (8bit):6.2994726754710735
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0DFA65976DA7822DB99118ABF2A50CC9
                                                                                                                                                              SHA1:A06FEEFFD56B3EF7A227E64099FC0213514D7879
                                                                                                                                                              SHA-256:F9F61393559BB1D76AB630B11953EC20C7A0D5979E48F27279E7BB0A92ABDA26
                                                                                                                                                              SHA-512:41CB3CCC7A2AEDB2B17517DE1DAC905ADAF9DB797E1FD487E7853438C2936096212582B20BFEFE03E267E0E1650AF503B802A13C43F0A55A6B803BEB1F93EE56
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....;f..........".......#....................@.............................@6.......5...`..........................................w(.U...Xw(.h.....0.p.... ...*..H.4......6..-...Y(......................X(.(...P.#.8...........x.(.....xv(.@....................text...e.#.......#................. ..`.rdata........#.......#.............@..@.data...|.....)......l).............@....pdata...*... ...,....-.............@..@.gxfg...04...P/..6...:..............@..@.retplne....../......p...................tls........../......r..............@....voltbl.F...../......v..................CPADinfo8...../......x..............@...LZMADEC......./......z.............. ..`_RDATA......../.....................@..@malloc_h......0..................... ..`.rsrc...p.....0.....................@..@.reloc...-....6.......4.............@..B........................................................

                                                                                                                                                              C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\124.0.25069.209.manifest

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):230
                                                                                                                                                              Entropy (8bit):4.948847353848498
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:E31E79462CDFBE2C06535260D38CB748
                                                                                                                                                              SHA1:2CBA4D516A7912815FE725C6B83D2CDE22F4C491
                                                                                                                                                              SHA-256:CF687B88CA7ED42553D70AD148444798727F2FBFB1A6D98A65C64D97FCFD1019
                                                                                                                                                              SHA-512:3B8C79EFE016B07E321AF584948F2840C40D197815471F5B00F18F79D7FE6C527FFEA2ECF1A63F6732D969240BAC5BF34BA6C96B9968CC14657DD6550581D097
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:<assembly.. xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <assemblyIdentity.. name='124.0.25069.209'.. version='124.0.25069.209'.. type='win32'/>.. <file name='chrome_elf.dll'/>..</assembly>..

                                                                                                                                                              C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\AVGBrowser.exe.sig

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1430
                                                                                                                                                              Entropy (8bit):7.565609826260146
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:DFFA4A87A891A94C0C0597BED2DB0C88
                                                                                                                                                              SHA1:8BD1D631567D96015D328AAD53164827FB6EDEC2
                                                                                                                                                              SHA-256:CACCF67DA410E979CCAC240F292F1ED73925DA4EEF72AB3A2279D5A9150EBD5B
                                                                                                                                                              SHA-512:31163C3479E4341DBCF8C05E0B2F4ED3CA28EF838C1F24FFAF50784EA8B1D6BF5B592396647C483DC3F7DE1EB089E599B128E9532773FE0CD45936675B012241
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:....0...0..........}*<j.......L..0...*.H........0}1.0...U....US1.0...U....Washington1.0...U....Kirkland1.0...U....Google1.0...U....Widevine1"0 ..U....widevine-codesign-root-ca0...201209060149Z..301207060149Z0}1.0...U....DE1.0...U....Berlin1.0...U....castLabs GmbH1.0...U....3PL1.0...U....castlabs.com1 0...*.H........info@castlabs.com0.."0...*.H.............0.........>..l7<...Y.l....&pdt....5..G:..g..?H!......]...V.l...@.E"..,.P.,....Ia.-..E..S..[...1.v<G.}.VT6Bw.....52......M._.-.J&qV'.Cy8..{k...........~...j....,V..D....|.;'.....(T....9..N.R....*..SnG.3.I.]..o......}..2.|...T~....k.U......2Z.t%..i...?[.J"u..........0..0...U........ib....h.uP{Ih.B..]0...U.#..0....=..tW....!.B.#U).0...U....0.0...U........0...U.%..0...+.......0...+.....y........0...*.H..............r...W.)......Z........$...g..z..+.i.I3...).......J(...wk.S.d..,..A).N..E/w.j..H.7.h.4pHlm.;..A....M;-'.i.P+.:h.;`:y.~.....(jt./..l....[Oc..n.N....9^...y..;.F....7..z..e..uD.h.w...k/LE.0.c]9$8.*...S....l.Y<.s\[

                                                                                                                                                              C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\aswEngineConnector.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe
                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):190904
                                                                                                                                                              Entropy (8bit):6.359989785885553
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:EE3EDCFEBEAEA2F9CFDE98E1B0CB38C0
                                                                                                                                                              SHA1:206AD2E294E2970CF225797E2C09D715397E4FD6
                                                                                                                                                              SHA-256:1D00B43012E63FC6DB42678F6251CA9584A657F10CBEF4AB68A3885D0459B739
                                                                                                                                                              SHA-512:65E4C62952960E965F6F2E3722F07C7C203B8E753484FB793FB307ED1B5980FCC51C14D09264D09A944BD3AC9693E3EF60C6EB79CFC1E0D2073AAB2A53743072
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v,............~......~S......~............~......~......~.......~.............~......~...................~...Rich...................PE..d...+..f.........." ...&............@5..............................................I.....`A........................................p...x......d...............L...H...p)...........o..............................`n..@............................................text............................... ..`.rdata..............................@..@.data...............................@....pdata..L...........................@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................

                                                                                                                                                              C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\browser_crash_reporter.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe
                                                                                                                                                              File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):5005240
                                                                                                                                                              Entropy (8bit):6.517201198694851
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:2CA6D4F47E44AB7885329BDE1F57F333
                                                                                                                                                              SHA1:FBEB1A2C25093D070AE57E1D16FBA573DB367EE9
                                                                                                                                                              SHA-256:5302CBDA0AFB2023AC4447A9E5F538BCD18382556297A2200072FB73E49428A7
                                                                                                                                                              SHA-512:5D37F6CCF1557D536D4151AC35552DF326D17816F8046E70F0BD20F606A16500A9B98A63F6F444A1A3DEA8C5CD7D144F1263B54F95AA84F6DF5FA435B43E6AEB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$........L+y.-E*.-E*.-E*b_@+m-E*...*.-E*..A+.-E*hY@+.-E*..@+.-E*..F+.-E*b_F+.-E*.U.*.-E*.XA+.-E*.-E*.-E*.X@+.-E*sXA+.-E*b_A+.-E*b_D+.-E*.-D*./E*.L+.,E*.E+.-E*..*.-E*.-.*.-E*.G+.-E*Rich.-E*........................PE..d...T..f.........."....&..2..........v.........@............................. M.....y~L...`.........................................@.A.....(.A.,.....L......0J.D\..H6L.p)....L.Tj....:.......................:.(.....:.@.............2..............................text.....2.......2................. ..`.rdata...5....2..6....2.............@..@.data........ B..\....B.............@....pdata..D\...0J..^...bI.............@..@_RDATA........L.......K.............@..@.rsrc.........L.......K.............@..@.reloc..Tj....L..l....K.............@..B........................................................................................................................

                                                                                                                                                              C:\Program Files\AVG\Browser\Temp\source7676_1868020628\Safer-bin\124.0.25069.209\chrome.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe
                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):228612080
                                                                                                                                                              Entropy (8bit):6.71858832984727
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:9BBFA6D185BEA75131F38FB9F4EF9646
                                                                                                                                                              SHA1:76C6671C94122714F9A2AF02579118580853D08B
                                                                                                                                                              SHA-256:C4CCB277537AAC56E7E7CFA46E15EC6E4006DB99D40AB180099A7D347BBD1F95
                                                                                                                                                              SHA-512:C2841C0EB99FD969A204CD40BA07B4739019D8B7A0F48E83768AA242DBCAA2E535FC0E3773D86E9A8B4742B5BF4C73D75AD87FB952278AA08446A9F07EE1C1DB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....;f.........." ......}..........1...................................... ......b.....`A.........................................r.......s..|.....{...........[.H........~.....8z..8...................Hs..(...@.~.8...........H...8....!.......................text.....}.......}................. ..`.rdata.. .~...}...~...}.............@..@.data...P.!......@..................@....pdata....[.......[.................@..@.gxfg...PE....z..F....f.............@..@.retplne......z......*g..................rodata.......{......,g............. ..`.tls....!.... {......>g.............@....voltbl.t....0{......Dg.................CPADinfo8....@{......Fg.............@...LZMADEC......P{......Hg............. ..`_RDATA.......p{......Zg.............@..@malloc_h......{......\g............. ..`prot..........{......bg.............@..@.rsrc.........{......dg.............@..@.reloc........~.

                                                                                                                                                              C:\Program Files\AVG\Browser\Temp\source7676_1868020628\secure.7z

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe
                                                                                                                                                              File Type:7-zip archive data, version 0.4
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):377630432
                                                                                                                                                              Entropy (8bit):6.946458986175724
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:E53CECA664C9C956F183C10990BCF248
                                                                                                                                                              SHA1:B59F00A971AA3C81913F6875D854189BB868F97E
                                                                                                                                                              SHA-256:4E7F911A145FE3719F60E27E821E247261B1591E879291315005150C73ED4F6F
                                                                                                                                                              SHA-512:ED168B05C6F9151FDD67A6526740E7A441BEB48FEA7CB8B8A5A8A5B4DE78D6DBC6FF944A5289CF7988A9B6FE6FD376588A800A1BB13400DE0942824E2791381E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:7z..'...R..V........&.........}<assembly.. xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <assemblyIdentity.. name='124.0.25069.209'.. version='124.0.25069.209'.. type='win32'/>.. <file name='chrome_elf.dll'/>..</assembly>..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v,............~......~S......~............~......~......~.......~.............~......~...................~...Rich...................PE..d...+..f.........." ...&............@5..............................................I.....`A........................................p...x......d...............L...H...p)...........o..............................`n..@............................................text............................... ..`.rdata..............................@..@.data...............................@....pdata..L...........................@..@_RDATA............................

                                                                                                                                                              C:\ProgramData\Microsoft\Network\Downloader\edb.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1310720
                                                                                                                                                              Entropy (8bit):0.8307298153167398
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5A87DDF5CDC00B0F334A120BAF4C7AD0
                                                                                                                                                              SHA1:405CB6A141FE9B224CB550ECD584CF3DDDAB09CC
                                                                                                                                                              SHA-256:C94FF693957EF6F69C44E8BC0E98DDC392268DAA58E364BCD9856BE0332FAF72
                                                                                                                                                              SHA-512:75347BD0FF96B477EEF3891622010C4240B14642AC0FD7BB1BDD59C7841D34E692ACB25388CBD0EFB83332E50D8E27B5A5EF5758B742C4421545D6DCAB54E1DF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

                                                                                                                                                              C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                              File Type:Extensible storage engine DataBase, version 0x620, checksum 0xae2dbe9f, page size 16384, DirtyShutdown, Windows version 10.0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1310720
                                                                                                                                                              Entropy (8bit):0.6585683251503744
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:4E3B2D769B43272C87897735A5FDF141
                                                                                                                                                              SHA1:C57E1184DF81FB29EB482EBC3C0ECD578B88FD19
                                                                                                                                                              SHA-256:7ACE44ED813112C749FCD199EC6F224F701DC3205DFC7EB90575107B4F96150F
                                                                                                                                                              SHA-512:5885BD3DB82DD5EFED525DD4341A3A8B9A87E3193C474BD2A4069D93B1D81C2CA042D24DD9241FAB19523A138E44AA2EB8CCBF9AB849A378D7544ADAAF6245E8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.-..... ...............X\...;...{......................0.z..........{..7....|C.h.|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...................................Sqa7....|C..................rZ7....|C..........................#......h.|.....................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16384
                                                                                                                                                              Entropy (8bit):0.08087832191563288
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:3AA588D89527EF8F0D82A27B64389E6E
                                                                                                                                                              SHA1:C11FA88A44E2FD85480EAAF8201E5F54521BC74A
                                                                                                                                                              SHA-256:4195E56E560A91F88A19CB3952350EF591728B440A39DD9C247CD87217ED6209
                                                                                                                                                              SHA-512:775774F711ECABEF36D23CC9118109DA24BB3C8D3FA7AB92D61A6D66CFB3011DFA543AE008DDF96FC34E7882BFDF6BDE6B33E246DDEA96FB06056198F67B4768
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.rX......................................;...{..7....|C......{...............{.......{...XL......{...................rZ7....|C.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\470741ec-8bbe-46df-963b-4c18a8035437.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):7242
                                                                                                                                                              Entropy (8bit):5.851245751549517
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0D31FE9461BCCC2FA1D25ED129B6DD5F
                                                                                                                                                              SHA1:859F4614DE3D8E9105CDD2CF26BED8E4142C68C6
                                                                                                                                                              SHA-256:889C1445AE4362EE6EB9502402884E6B5C457297E17BCAAD676508C99A14DC53
                                                                                                                                                              SHA-512:05198CC24F881C77C0340B25F9568F19CEA0F913D4D96685BE48D6A4E5F1FE6C3FD7720460A0A50254B11124702132F5D689554D40BEE80907BA4A035BF054EA
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"autolaunch":{"engagement_count":-1,"id":"422","restore_tabs":false,"show_infobar_count":-2,"show_ntp":false,"skip_infobar_count":1,"start_maximized":false,"state":3,"timestamp":1643760000},"background_mode":1,"breadcrumbs":{"enabled":false,"enabled_time":"13361901387716892"},"browser":{"shortcut_migration_version":"124.0.25069.209"},"engagement":{"changed_by_user":{"background_mode":false}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"last_run_browser_version":"124.0.25069.209","latest_experiments_overrides":["EnableTabMuting","browserProtect","BrowserPro","AvastVPN","BackgroundImages","PhalanxContentScanning","InterpolateGoogleTiles","NtpExtension","ReplaceUserAgent","first-search-omnibox","GpuSpoofProcessName","PhalanxJavaScriptScriptsScanning","RedesignedClose"],"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"optimization_guide":{"model_store_metadata":{}},"os_crypt":{"app_b

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\556a7850-bdc0-4125-9a89-a01ea420e633.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):7242
                                                                                                                                                              Entropy (8bit):5.851245751549517
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0D31FE9461BCCC2FA1D25ED129B6DD5F
                                                                                                                                                              SHA1:859F4614DE3D8E9105CDD2CF26BED8E4142C68C6
                                                                                                                                                              SHA-256:889C1445AE4362EE6EB9502402884E6B5C457297E17BCAAD676508C99A14DC53
                                                                                                                                                              SHA-512:05198CC24F881C77C0340B25F9568F19CEA0F913D4D96685BE48D6A4E5F1FE6C3FD7720460A0A50254B11124702132F5D689554D40BEE80907BA4A035BF054EA
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"autolaunch":{"engagement_count":-1,"id":"422","restore_tabs":false,"show_infobar_count":-2,"show_ntp":false,"skip_infobar_count":1,"start_maximized":false,"state":3,"timestamp":1643760000},"background_mode":1,"breadcrumbs":{"enabled":false,"enabled_time":"13361901387716892"},"browser":{"shortcut_migration_version":"124.0.25069.209"},"engagement":{"changed_by_user":{"background_mode":false}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"last_run_browser_version":"124.0.25069.209","latest_experiments_overrides":["EnableTabMuting","browserProtect","BrowserPro","AvastVPN","BackgroundImages","PhalanxContentScanning","InterpolateGoogleTiles","NtpExtension","ReplaceUserAgent","first-search-omnibox","GpuSpoofProcessName","PhalanxJavaScriptScriptsScanning","RedesignedClose"],"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"optimization_guide":{"model_store_metadata":{}},"os_crypt":{"app_b

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\BrowserMetrics\BrowserMetrics-665DDE4A-151C.pma

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4194304
                                                                                                                                                              Entropy (8bit):0.36533352061658186
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:A594CE4ADB404F814FBB3F39BC2B7220
                                                                                                                                                              SHA1:35602662AFC5F563E5C7869245951CB6A93C43A1
                                                                                                                                                              SHA-256:1DD95BC63822E6430E230E5B66D6DB1294509D5A0192A0C61CE30167D5B5C758
                                                                                                                                                              SHA-512:F738563D70AB661B9ACD22C8614AD239A5080F5B053D9C9EE8459F4B0FBDE65B4536846DF7780FDC73BE92FC760BB0C94E1574644627D4FDCDF99C0D20CBED24
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:...@..@...@.....C.].....@...............(...................`... ...i.y.........BrowserMetrics......i.y..Yd.........A.......d...2......._.z.....Gy.7....................Gy.7....................UMA.PersistentAllocator.EarlyHistograms.BrowserMetrics......i.y.["......................................................................................................................... ..."...$...&...(...*...-...0...3...6...9...<...@...D...H...L...P...U...Z..._...d...............i.y..Yd........A...............`...v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.3...............124.0.25069.209-64-devel".en-GB*...Windows NT..10.0.190452(..x86_64..?.......".tqvqdc20,1...x86_64J..X.*..D...J..m#:^....AP....:....................L..H...,...CookieDeprecationFacilitatedTestingLabelOnly....LabelOnly1_20240207..<..8...(...SyntheticOptimizationGuideRemoteFetching....Disabled.$.. .......CPSS

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Crashpad\settings.dat

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):40
                                                                                                                                                              Entropy (8bit):3.3041625260016576
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:3B57EA42ABDF1867B6A6444466B3F417
                                                                                                                                                              SHA1:435EE72440FBC6E483BE470F72D2AAC2D2C0D378
                                                                                                                                                              SHA-256:99FC896AEEF47A3B3A76891C5734F4651867EE0A7122095443026FCE732A4C03
                                                                                                                                                              SHA-512:D9B30304C54EF3C876A90B3A76D6530409827D737822EDD1E5F0A08DE520217E91D57B4EA1AD770A63B3360B3AC93C000FCCF767D9C9080B4506F9E2039DE400
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:sdPC.....................xp....L..n4..Z

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\055fc89c-ca85-4444-bd99-613387dd2fe2.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2615
                                                                                                                                                              Entropy (8bit):4.177433666485558
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F5862F6C36116ED2013C5138F7C8A3EA
                                                                                                                                                              SHA1:DDA61AFFA07548804BB69B16C4881DFBEA7D9D49
                                                                                                                                                              SHA-256:E2F500E27D8A4540BAC38CEE238788F597846C6E7064DEE046FD7B2BFB3F0842
                                                                                                                                                              SHA-512:16D360C87775B65182319EFD288BC0D3A22CCD3AFDFCF97379F1D8E5DA68FDC28A502A103B9AF1D1A4F91FE0F7B1CB84FE5B61389B95CBD259496024464FCCE2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{.. "checksum": "6aa34186c8de766a8c605ffa8bec0703",.. "roots": {.. "bookmark_bar": {.. "children": [ ],.. "date_added": "13361901388008789",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "0bc5d13f-2cba-5d74-951f-3f233fe6c908",.. "id": "1",.. "name": "Bookmarks bar",.. "type": "folder".. },.. "other": {.. "children": [ ],.. "date_added": "13361901388008793",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "82b081ec-3dd3-529c-8475-ab6c344590dd",.. "id": "2",.. "name": "Other bookmarks",.. "type": "folder".. },.. "sponsored": {.. "children": [ {.. "children": [ ],.. "date_added": "13361901388200232",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "e06652f2-60b8-4322-9101-a0abb4e3849c",.. "id": "6",.. "name": "Act

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\19eaa566-7d00-4257-b013-c30f374965a5.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):11041
                                                                                                                                                              Entropy (8bit):5.568436236685337
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:B7863800FCFE797C052BE215ECD86ED3
                                                                                                                                                              SHA1:AB539DB2C518D3AE4311C37CC36E567D8305F402
                                                                                                                                                              SHA-256:89BF877328D13A146C13F7AA85D7E5DA472A398E02533B2DE09699189D42CD3B
                                                                                                                                                              SHA-512:732579321BBC36D378D32FEA359D75772E1FB54398EE7120ED02C746C74BFA69EA39A89D75E35547981DB51B9ED225446ED27CC84D2986FC874D89195AF7BD3C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"browser":{"show_home_button":false},"enable_do_not_track":true,"extensions":{"install":{"denylist":["*"]},"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13361901388151306","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13361901388151306","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore","https://addons.avast.com/","https://addons.avg.com/","https://addons.ccleaner.com/","https://addons.avast.securebrowser.com","https://addons.avg.securebrowser.com","https://addons.ccleaner.securebrowser.com","https://addons.avira.securebrowser.com","https://addons.norton.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\20b8bbc4-ef65-4edd-b8c4-ea938dca8134.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:MS Windows icon resource - 13 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):172725
                                                                                                                                                              Entropy (8bit):5.121138096667967
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:FC07ECAE96473EB238D9570AC145B9C6
                                                                                                                                                              SHA1:40E791064C6AB7FED561242FE76CEF504E9D67F5
                                                                                                                                                              SHA-256:7F1D458D061048520FF23161194483CDEC65A85A83176AFDF570F2E8AF441C42
                                                                                                                                                              SHA-512:14EB4C3FB47ACB4684545A3AB7A4F3488C18B25D8342C34E32DA4C9B25B8C62806B06BACA5F6AEE834284DE45325680A5275F06077CBB6761A2386550FA5AC84
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:............ .H............. ............... .p............. .h...n......... ............... ......... .... .....n...((.... .h.......00.... ..%..~H..@@.... .(B..&n..``.... .....N......... .(....D........ ..U...M..(............. ....................................f....>...c..X.............:...S....s...M...C.........(Y......W.........s...'...'..U..(.../................$...7.....(...X................^...VC....^..H.................vT..e:.X........l?..9...V&..c8..mI...............cU;..O..hC.X........................................(............. ..................................^.....j....F...]..U.................;.........g...J...W...S...3............. .......).........[...@...5....f....$V.."...+.................2...&......Q..1........................{.......Lu....:...+........................8...p=...;V..(........................cG..l?.U..U.....|..J*...q...v..zY..qE..nJ..UU............'.I...2...F...]1..qN..vX...................].R@...R#.a:.T..............................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\334be9c1-d34a-4d4b-ab58-0b324ba44b08.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:MS Windows icon resource - 13 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):172725
                                                                                                                                                              Entropy (8bit):5.121138096667967
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:FC07ECAE96473EB238D9570AC145B9C6
                                                                                                                                                              SHA1:40E791064C6AB7FED561242FE76CEF504E9D67F5
                                                                                                                                                              SHA-256:7F1D458D061048520FF23161194483CDEC65A85A83176AFDF570F2E8AF441C42
                                                                                                                                                              SHA-512:14EB4C3FB47ACB4684545A3AB7A4F3488C18B25D8342C34E32DA4C9B25B8C62806B06BACA5F6AEE834284DE45325680A5275F06077CBB6761A2386550FA5AC84
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:............ .H............. ............... .p............. .h...n......... ............... ......... .... .....n...((.... .h.......00.... ..%..~H..@@.... .(B..&n..``.... .....N......... .(....D........ ..U...M..(............. ....................................f....>...c..X.............:...S....s...M...C.........(Y......W.........s...'...'..U..(.../................$...7.....(...X................^...VC....^..H.................vT..e:.X........l?..9...V&..c8..mI...............cU;..O..hC.X........................................(............. ..................................^.....j....F...]..U.................;.........g...J...W...S...3............. .......).........[...@...5....f....$V.."...+.................2...&......Q..1........................{.......Lu....:...+........................8...p=...;V..(........................cG..l?.U..U.....|..J*...q...v..zY..qE..nJ..UU............'.I...2...F...]1..qN..vX...................].R@...R#.a:.T..............................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\65219df9-e7cb-40ef-9bb2-135b7e321f0c.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:very short file (no magic)
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1
                                                                                                                                                              Entropy (8bit):0.0
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                                                                                              SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                                                                                              SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                                                                                              SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\74f45c9d-acf6-498b-afe9-5026fe93f483.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with very long lines (41435), with no line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41511
                                                                                                                                                              Entropy (8bit):5.06262236330887
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:798B3F545EC40BBDB5A4E3E90B4A7DE9
                                                                                                                                                              SHA1:7785D3FB3338A1FCA4D7E3FCC60456F14475B6D9
                                                                                                                                                              SHA-256:ED4EA4E264CE12DB46C1BEFE86A01D6AF406999CB6EE50234F3EC5C817053E29
                                                                                                                                                              SHA-512:CC1E70DAAA3D63234818D3E98C555AA87124C618BFE9C7485292F525347171CF7DF57E862BB67E5FBF1DBB56F73D59ACE72590ADF3458E8E1994C40F1CD315F2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"account_tracker_service_last_update":"13361901388200588","adblock":{"install_first_run_subscriptions":false},"alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13361901388147675","apps":{"shortcuts_arch":"","shortcuts_version":0},"autofill":{"last_version_deduped":124},"bookmark_bar":{"show_apps_shortcut":true,"show_on_all_tabs":true},"browser":{"has_seen_welcome_page":false,"show_home_button":false},"countryid_at_install":17224,"default_apps_install_state":3,"distribution":{"features":{},"import_bookmarks_from_file":"master_bookmarks.html","import_from_browser":7,"is_imported_browser_default":true},"domain_diversity":{"last_reporting_timestamp":"13361901388200510"},"enable_do_not_track":true,"engagement":{"changed_by_user":{"extensions":{"pbnlklembegknchclakjohhpdccfllbe":{"state":false},"pnhojlpkdnfhikpofiijpojgpejkdgpj":{"state":false},"safer":{"security":{"tiles_last_state":{"adb":{"mode":false}}}}},"translate":{"enabled":false}},"extensio

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\7e58ebf4-031a-4355-a5a7-a401f0ca9352.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):414
                                                                                                                                                              Entropy (8bit):5.0566065435114025
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46522B69C99AAEC14F77529A572B3C7E
                                                                                                                                                              SHA1:12D1055295A3B820575C6E8A0EDFA4249796CF5F
                                                                                                                                                              SHA-256:6476B20B1BE73A3B057B094B9F249C8FA704F8FC09BADB55D3550173A49D51A9
                                                                                                                                                              SHA-512:4E9FFCA2ABF941D6A7A0C318FE9A244CF8FCD4C45E73661E33F83F08463FCD3FE3FADF10E5A2C6686CF054295C648CA1C7E44449D159676AAC98AE95636AC906
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{.. "epochs": [ {.. "calculation_time": "13361901393389632",.. "config_version": 0,.. "model_version": "0",.. "padded_top_topics_start_index": 0,.. "taxonomy_version": 0,.. "top_topics_and_observing_domains": [ ].. } ],.. "hex_encoded_hmac_key": "23239D7002DD3804E7DC70911AC53E69915BA708C24A5A4C6CFCFCEEA695DA2B",.. "next_scheduled_calculation_time": "13362506193389739"..}..

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\AVG Secure Browser Profile.ico (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:MS Windows icon resource - 13 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):172725
                                                                                                                                                              Entropy (8bit):5.121138096667967
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:FC07ECAE96473EB238D9570AC145B9C6
                                                                                                                                                              SHA1:40E791064C6AB7FED561242FE76CEF504E9D67F5
                                                                                                                                                              SHA-256:7F1D458D061048520FF23161194483CDEC65A85A83176AFDF570F2E8AF441C42
                                                                                                                                                              SHA-512:14EB4C3FB47ACB4684545A3AB7A4F3488C18B25D8342C34E32DA4C9B25B8C62806B06BACA5F6AEE834284DE45325680A5275F06077CBB6761A2386550FA5AC84
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:............ .H............. ............... .p............. .h...n......... ............... ......... .... .....n...((.... .h.......00.... ..%..~H..@@.... .(B..&n..``.... .....N......... .(....D........ ..U...M..(............. ....................................f....>...c..X.............:...S....s...M...C.........(Y......W.........s...'...'..U..(.../................$...7.....(...X................^...VC....^..H.................vT..e:.X........l?..9...V&..c8..mI...............cU;..O..hC.X........................................(............. ..................................^.....j....F...]..U.................;.........g...J...W...S...3............. .......).........[...@...5....f....$V.."...+.................2...&......Q..1........................{.......Lu....:...+........................8...p=...;V..(........................cG..l?.U..U.....|..J*...q...v..zY..qE..nJ..UU............'.I...2...F...]1..qN..vX...................].R@...R#.a:.T..............................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\AVG Secure Browser Profile.ico~RF5e5b74.TMP (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:MS Windows icon resource - 13 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):172725
                                                                                                                                                              Entropy (8bit):5.121138096667967
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:FC07ECAE96473EB238D9570AC145B9C6
                                                                                                                                                              SHA1:40E791064C6AB7FED561242FE76CEF504E9D67F5
                                                                                                                                                              SHA-256:7F1D458D061048520FF23161194483CDEC65A85A83176AFDF570F2E8AF441C42
                                                                                                                                                              SHA-512:14EB4C3FB47ACB4684545A3AB7A4F3488C18B25D8342C34E32DA4C9B25B8C62806B06BACA5F6AEE834284DE45325680A5275F06077CBB6761A2386550FA5AC84
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:............ .H............. ............... .p............. .h...n......... ............... ......... .... .....n...((.... .h.......00.... ..%..~H..@@.... .(B..&n..``.... .....N......... .(....D........ ..U...M..(............. ....................................f....>...c..X.............:...S....s...M...C.........(Y......W.........s...'...'..U..(.../................$...7.....(...X................^...VC....^..H.................vT..e:.X........l?..9...V&..c8..mI...............cU;..O..hC.X........................................(............. ..................................^.....j....F...]..U.................;.........g...J...W...S...3............. .......).........[...@...5....f....$V.."...+.................2...&......Q..1........................{.......Lu....:...+........................8...p=...;V..(........................cG..l?.U..U.....|..J*...q...v..zY..qE..nJ..UU............'.I...2...F...]1..qN..vX...................].R@...R#.a:.T..............................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Bookmarks (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2615
                                                                                                                                                              Entropy (8bit):4.177433666485558
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F5862F6C36116ED2013C5138F7C8A3EA
                                                                                                                                                              SHA1:DDA61AFFA07548804BB69B16C4881DFBEA7D9D49
                                                                                                                                                              SHA-256:E2F500E27D8A4540BAC38CEE238788F597846C6E7064DEE046FD7B2BFB3F0842
                                                                                                                                                              SHA-512:16D360C87775B65182319EFD288BC0D3A22CCD3AFDFCF97379F1D8E5DA68FDC28A502A103B9AF1D1A4F91FE0F7B1CB84FE5B61389B95CBD259496024464FCCE2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{.. "checksum": "6aa34186c8de766a8c605ffa8bec0703",.. "roots": {.. "bookmark_bar": {.. "children": [ ],.. "date_added": "13361901388008789",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "0bc5d13f-2cba-5d74-951f-3f233fe6c908",.. "id": "1",.. "name": "Bookmarks bar",.. "type": "folder".. },.. "other": {.. "children": [ ],.. "date_added": "13361901388008793",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "82b081ec-3dd3-529c-8475-ab6c344590dd",.. "id": "2",.. "name": "Other bookmarks",.. "type": "folder".. },.. "sponsored": {.. "children": [ {.. "children": [ ],.. "date_added": "13361901388200232",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "e06652f2-60b8-4322-9101-a0abb4e3849c",.. "id": "6",.. "name": "Act

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\BrowsingTopicsSiteData

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045001, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):28672
                                                                                                                                                              Entropy (8bit):0.43785293753385396
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5C882D4F0BF1B78D098244A562626EEB
                                                                                                                                                              SHA1:06C7305BCABACC000FDAB68E645634A7F1D3BE95
                                                                                                                                                              SHA-256:A24DCD6CB1D5F04A5EB2168CCF28A56A975D2933A7B47BB7E34D87F5A3035379
                                                                                                                                                              SHA-512:36ECD9E2B84FC4B3B38ED523CDE7A021680147511E087564A6F962CD5967B80E5857F61580002CAF3CF8C8A30F89481141FCC02C45113816298B208FDD2BEDFF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................v..........g.......o..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\BrowsingTopicsState (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):414
                                                                                                                                                              Entropy (8bit):5.0566065435114025
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46522B69C99AAEC14F77529A572B3C7E
                                                                                                                                                              SHA1:12D1055295A3B820575C6E8A0EDFA4249796CF5F
                                                                                                                                                              SHA-256:6476B20B1BE73A3B057B094B9F249C8FA704F8FC09BADB55D3550173A49D51A9
                                                                                                                                                              SHA-512:4E9FFCA2ABF941D6A7A0C318FE9A244CF8FCD4C45E73661E33F83F08463FCD3FE3FADF10E5A2C6686CF054295C648CA1C7E44449D159676AAC98AE95636AC906
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{.. "epochs": [ {.. "calculation_time": "13361901393389632",.. "config_version": 0,.. "model_version": "0",.. "padded_top_topics_start_index": 0,.. "taxonomy_version": 0,.. "top_topics_and_observing_domains": [ ].. } ],.. "hex_encoded_hmac_key": "23239D7002DD3804E7DC70911AC53E69915BA708C24A5A4C6CFCFCEEA695DA2B",.. "next_scheduled_calculation_time": "13362506193389739"..}..

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Code Cache\js\ba678a2fbd8c358c_0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):298
                                                                                                                                                              Entropy (8bit):5.452177228652527
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:65B4ABBB1A882D70676488C826E42E0A
                                                                                                                                                              SHA1:7354D71E97490D1C43B511C74CE31484F775FF17
                                                                                                                                                              SHA-256:DC9CC58ADBF373F82E285D80A652BCFFD7C3250E685C853A4D567AAD5965D13C
                                                                                                                                                              SHA-512:35FF406317161D82D98209C0CFB7E93542D1175BF8ABFA518FDBFD532BE64777D91D67F589F9EBD88407EF4373AC8A0FA0B8EE644E34645300706EADEB645A7E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:0\r..m......v...!.Hh...._keychrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/thunk.js .chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/.A..Eo..........................@............/.PK.dz'6....nN'....T).P^............................d_&AUp*.5.V..Z..../..j).....A..Eo.......EE.L.......

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Code Cache\js\c1ab13ddfe50007b_0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):303
                                                                                                                                                              Entropy (8bit):5.506403240685311
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:8D89CF1ACF2C51CEA23DF83A059634CD
                                                                                                                                                              SHA1:F0C95BEBDDFAC77E2D5B89035990182E42D978C5
                                                                                                                                                              SHA-256:C889B81C65AE7AC6F311BA58A9017A9FC801CB9497278EF22118EA9B31103C15
                                                                                                                                                              SHA-512:F6FD3D89740937A45436555580FB6262448035B96A8BF50B1252459AA7EF56E026B3C5F090B870A9848405C4021D853118A31C230B93FAA5D5295ADA365A33DD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:0\r..m......{......3...._keychrome-extension://jfijboeaeajnoejbcdbhejlnmhepeige/background.js .chrome-extension://jfijboeaeajnoejbcdbhejlnmhepeige/.A..Eo..........................@...........VUh..~..U.!|..;.........3.d..._.........................FT.........B..G..s7..3.y.a...A..Eo........G.L.......

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Code Cache\js\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):24
                                                                                                                                                              Entropy (8bit):2.1431558784658327
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                              SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                              SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                              SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:0\r..m..................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Code Cache\js\index-dir\temp-index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):96
                                                                                                                                                              Entropy (8bit):3.8402033156653053
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:AF3420E83BB3CB60448C1A02E3BBC5D5
                                                                                                                                                              SHA1:25E9CA83FFFFF7E9A3636EDC27DE5865E49A5998
                                                                                                                                                              SHA-256:D1F594F9E8144D6C437353EAC2CB539CCC424BC7925F2E14374661B7330BA407
                                                                                                                                                              SHA-512:CD88D543F66456455BF218675A4299831984823B08DD4E346FCD166CD11ABB5BB9C6B6A3399BE5FA7C9304B1347F21AAA44DE6954AF24973335C9047B89116CD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:X...B.e.oy retne.........................5../.g..1...x/.........{.P......1...x/..............x/.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Code Cache\js\index-dir\the-real-index (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):96
                                                                                                                                                              Entropy (8bit):3.8402033156653053
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:AF3420E83BB3CB60448C1A02E3BBC5D5
                                                                                                                                                              SHA1:25E9CA83FFFFF7E9A3636EDC27DE5865E49A5998
                                                                                                                                                              SHA-256:D1F594F9E8144D6C437353EAC2CB539CCC424BC7925F2E14374661B7330BA407
                                                                                                                                                              SHA-512:CD88D543F66456455BF218675A4299831984823B08DD4E346FCD166CD11ABB5BB9C6B6A3399BE5FA7C9304B1347F21AAA44DE6954AF24973335C9047B89116CD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:X...B.e.oy retne.........................5../.g..1...x/.........{.P......1...x/..............x/.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Code Cache\js\index-dir\the-real-index~RF5e6dc4.TMP (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):96
                                                                                                                                                              Entropy (8bit):3.8402033156653053
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:AF3420E83BB3CB60448C1A02E3BBC5D5
                                                                                                                                                              SHA1:25E9CA83FFFFF7E9A3636EDC27DE5865E49A5998
                                                                                                                                                              SHA-256:D1F594F9E8144D6C437353EAC2CB539CCC424BC7925F2E14374661B7330BA407
                                                                                                                                                              SHA-512:CD88D543F66456455BF218675A4299831984823B08DD4E346FCD166CD11ABB5BB9C6B6A3399BE5FA7C9304B1347F21AAA44DE6954AF24973335C9047B89116CD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:X...B.e.oy retne.........................5../.g..1...x/.........{.P......1...x/..............x/.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Code Cache\wasm\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):24
                                                                                                                                                              Entropy (8bit):2.1431558784658327
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                              SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                              SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                              SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:0\r..m..................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Code Cache\wasm\index-dir\temp-index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):48
                                                                                                                                                              Entropy (8bit):2.9972243200613975
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:40B333BF3C41358D4913FF73465D9D9D
                                                                                                                                                              SHA1:A917ED90F8CEDA8E736F77A3C8C4CE20676C65E5
                                                                                                                                                              SHA-256:6E49208D8EAE5A6DD9058316BFC9303C0AA0EDD1E33DC7723C9069F1CCBAB262
                                                                                                                                                              SHA-512:EC8B92FA0DC00BF14D9AE2741170C66780F01307F45D63551BD77D13E9FB598C2A74DD7502DDA5772468B048D584FFF4ACDC6701F66904FCB6D9E14948184E11
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:(...I..`oy retne........................81...x/.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Code Cache\wasm\index-dir\the-real-index (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):48
                                                                                                                                                              Entropy (8bit):2.9972243200613975
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:40B333BF3C41358D4913FF73465D9D9D
                                                                                                                                                              SHA1:A917ED90F8CEDA8E736F77A3C8C4CE20676C65E5
                                                                                                                                                              SHA-256:6E49208D8EAE5A6DD9058316BFC9303C0AA0EDD1E33DC7723C9069F1CCBAB262
                                                                                                                                                              SHA-512:EC8B92FA0DC00BF14D9AE2741170C66780F01307F45D63551BD77D13E9FB598C2A74DD7502DDA5772468B048D584FFF4ACDC6701F66904FCB6D9E14948184E11
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:(...I..`oy retne........................81...x/.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\DawnGraphiteCache\data_0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.01057775872642915
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\DawnGraphiteCache\data_1

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):270336
                                                                                                                                                              Entropy (8bit):0.0012471779557650352
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                                                                                                              SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                                                                                                              SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                                                                                                              SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\DawnGraphiteCache\data_2

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.011852361981932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\DawnGraphiteCache\data_3

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.012340643231932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\DawnGraphiteCache\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):262512
                                                                                                                                                              Entropy (8bit):9.553120663130604E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F010F2C9DEA1ECAEF0A0A8EBB9D9A070
                                                                                                                                                              SHA1:10F41FB76E223C4488E82A8DC92DE5BBC3129532
                                                                                                                                                              SHA-256:58355C11D296FD7A22D47A8496510FED1A67F02EE45A890ED2C648A16E592E8E
                                                                                                                                                              SHA-512:E122D94ACE27E1059146103FCE98A91BE7612FD2A4E69A2EB45595F18A64D2A1EB48A05E66F15BD15E70A171E973F152F0585FE5035EB27B4279E077A4A6793F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................j....x/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\DawnWebGPUCache\data_0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.01057775872642915
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\DawnWebGPUCache\data_1

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):270336
                                                                                                                                                              Entropy (8bit):0.0012471779557650352
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                                                                                                              SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                                                                                                              SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                                                                                                              SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\DawnWebGPUCache\data_2

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.011852361981932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\DawnWebGPUCache\data_3

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.012340643231932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\DawnWebGPUCache\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):262512
                                                                                                                                                              Entropy (8bit):9.553120663130604E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:7F8AA65DCFFD5FDB1C753BD52AD1F671
                                                                                                                                                              SHA1:FF437329AEA6CA7172624F4A5BA32C74ABCFE207
                                                                                                                                                              SHA-256:C2C24A5437D5D1265B0233B5F22D73B699C4680FD77DB0B8F881C9581C1B12A1
                                                                                                                                                              SHA-512:5A993B7845752873DDE930F0D85DDDBE6245843FD81B741F14D4D95F3CCADF37A6D44F421713EFC2B6235D4A03E1F6D9A8821041BF917F3A279F89314CBEE9E2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.............................................x/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Extension Rules\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Extension Rules\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):76
                                                                                                                                                              Entropy (8bit):1.8784775129881184
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CC4A8CFF19ABF3DD35D63CFF1503AA5F
                                                                                                                                                              SHA1:52AF41B0D9C78AFCC8E308DB846C2B52A636BE38
                                                                                                                                                              SHA-256:CC5DACF370F324B77B50DDDF5D995FD3C7B7A587CB2F55AC9F24C929D0CD531A
                                                                                                                                                              SHA-512:0E9559CDA992AA2174A7465745884F73B96755008384D21A0685941ACF099C89C8203B13551DE72A87B8E23CDAAE3FA513BC700B38E1BF3B9026955D97920320
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.f.5................f.5................f.5................f.5...............

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Extension Rules\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Extension Rules\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):277
                                                                                                                                                              Entropy (8bit):5.184994730007974
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F8AAC958D8A828BD9F3B9A47561CE7FB
                                                                                                                                                              SHA1:F9EBCC9F61F15A42AF500B164AD4F3D69A0356F1
                                                                                                                                                              SHA-256:982A6D1BF276501A1015975E487C7D73E29F993A7941B43C78174620D1C1D0B5
                                                                                                                                                              SHA-512:C79851286EE8EC7EB84190501F3F8093A377612A48510AFF5B8E35BEE6ECF8811844B4F624F8C94F7779E94925E0C049D0AC9BC4BDB07B191EDA0F44FCF95155
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:2024/06/03-11:16:28.154 19e4 Creating DB C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Extension Rules since it was missing..2024/06/03-11:16:28.260 19e4 Reusing MANIFEST C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Extension Rules/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Extension Rules\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Extension Scripts\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Extension Scripts\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):76
                                                                                                                                                              Entropy (8bit):1.8784775129881184
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CC4A8CFF19ABF3DD35D63CFF1503AA5F
                                                                                                                                                              SHA1:52AF41B0D9C78AFCC8E308DB846C2B52A636BE38
                                                                                                                                                              SHA-256:CC5DACF370F324B77B50DDDF5D995FD3C7B7A587CB2F55AC9F24C929D0CD531A
                                                                                                                                                              SHA-512:0E9559CDA992AA2174A7465745884F73B96755008384D21A0685941ACF099C89C8203B13551DE72A87B8E23CDAAE3FA513BC700B38E1BF3B9026955D97920320
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.f.5................f.5................f.5................f.5...............

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Extension Scripts\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Extension Scripts\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):281
                                                                                                                                                              Entropy (8bit):5.201523880235115
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:BD7050C2BED364E9D8D577D3ECA43F5B
                                                                                                                                                              SHA1:33A17014E2D3FCD27C4FD47D48AB56917F8C6065
                                                                                                                                                              SHA-256:FA65A0084689457CBCDDA427A82FB079B5D6A4CA47478E0EAE39DE58F52ADEB4
                                                                                                                                                              SHA-512:EB74695EFD5E85E217F3734F61CCFA85F167D616230C4F255B159DC82C6934C4B4FC278760B27A1FDE4810EFB837296BD888FB945133AA081DBF856F8BC84EEE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:2024/06/03-11:16:28.584 19e4 Creating DB C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Extension Scripts since it was missing..2024/06/03-11:16:28.633 19e4 Reusing MANIFEST C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Extension Scripts/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Extension Scripts\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Extension State\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Extension State\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):228
                                                                                                                                                              Entropy (8bit):1.8784775129881184
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:AF1D95E1F9EB485393273B25446E1AE5
                                                                                                                                                              SHA1:1D762C96B1C38BA6A849A5B76D12FAC636B8D780
                                                                                                                                                              SHA-256:48D535BB330519C00D150578734C6CECB056C4B5CDD2A45C70590BC896D27D9F
                                                                                                                                                              SHA-512:826D207EDD55401E1C13249350814ADBB3AB00A135C46B8DA8BB7267751C70580F183982CCCBC1E47BF3E3F433F20BA1D2F2AFD601FCB67B635C0E7429558165
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Extension State\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Extension State\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):277
                                                                                                                                                              Entropy (8bit):5.18179188811074
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:25FF5E3294B6C7383C434C90B872885F
                                                                                                                                                              SHA1:3AC8C2853866837E18505705DFAFE32095C61478
                                                                                                                                                              SHA-256:23BED182E49D43E8450DD9FA1DE4A7EFCAE92A695AA51DAB705143012BF932B1
                                                                                                                                                              SHA-512:67D1D9252EAC88E3B7441D42F71A10F4F148F5A641E0CC056606946B038991CA5E0AF4E475849E22C63AB8C48DAA3F1F3F60EEED7809A85398CD24A5DAEAA657
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:2024/06/03-11:16:28.687 19e4 Creating DB C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Extension State since it was missing..2024/06/03-11:16:28.730 19e4 Reusing MANIFEST C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Extension State/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Extension State\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Favicons

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045001, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20480
                                                                                                                                                              Entropy (8bit):0.6972286527400751
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F56E431B1D09B7EE9076AC27C118CD1E
                                                                                                                                                              SHA1:FD00BDD050F91F04E12091C5786438F7F9B0B28F
                                                                                                                                                              SHA-256:0DB6438854D1086C869C9BDA01877547517CD155CC8336DC1838ABE3458B4BF6
                                                                                                                                                              SHA-512:54F7B298F2F7447FA071F58BDB1BB80ACBDB1C0DE4EA46760D391427649B8F255F040C650AB758700289AD5B35096EF8192EFF77C4E3C47D72713148A4AD3714
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................v..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\GPUCache\data_0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.01057775872642915
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\GPUCache\data_1

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):270336
                                                                                                                                                              Entropy (8bit):0.0012471779557650352
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                                                                                                              SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                                                                                                              SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                                                                                                              SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\GPUCache\data_2

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.011852361981932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\GPUCache\data_3

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.012340643231932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\GPUCache\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):262512
                                                                                                                                                              Entropy (8bit):9.553120663130604E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F88DBE288C1B44BB3FDB40BC22D38D70
                                                                                                                                                              SHA1:1F88AEA019EEC13DE5E39DB985DAC7163814F170
                                                                                                                                                              SHA-256:E1FAB5BEE04979FD0B7788850E1C923903A669158ACD51CC7D0DB0114456C0A4
                                                                                                                                                              SHA-512:A1169E1DF396225A82F1B26B9DFCBB8A83A6E8CB445A2C031D21D81D0D07AB0A20DD4C4201999028DF6F27ADE69BBC10D5F7A52567134767C996671D90A65863
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.........................................m...x/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\History

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045001, file counter 1, database pages 42, cookie 0x22, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):172032
                                                                                                                                                              Entropy (8bit):0.5518122597715659
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:BE25437D70CFD0631A1E7DEE51C27B4A
                                                                                                                                                              SHA1:2DEC5BEF0F50305BE9C8953CEE29BEB0B0226FB2
                                                                                                                                                              SHA-256:678CCE6027AC739CD65465BDDF3711C569E598FECAD7CEA4D5127FE3B26D0296
                                                                                                                                                              SHA-512:15F9EC95BDA5BB02F478FEF5A8C2285982768ACDD4E88D745E145AF2B5A240F34516B2BCE626D195E146CBA0384413BDD5551B69845C551D77F7ED8032E14444
                                                                                                                                                              Malicious:true
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:SQLite format 3......@ .......*..........."......................................................v............*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Local Extension Settings\jfijboeaeajnoejbcdbhejlnmhepeige\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Local Extension Settings\jfijboeaeajnoejbcdbhejlnmhepeige\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2501
                                                                                                                                                              Entropy (8bit):5.353842900511467
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:6D700ED88B6861DD79E35415FEFCBC73
                                                                                                                                                              SHA1:E6107D7645520C83CD2A1CDEBA2C18318B1751B9
                                                                                                                                                              SHA-256:395E2F8EB811F7CFB2229586F79953C06AC66EC549F3F4B08046FC9A2E3751B8
                                                                                                                                                              SHA-512:C0ED40386553D0823AE9EB7A73AC443393DE95E0D1383051E424A4E4E3093BA38E1EAEBD6D708745C315256FA63A04B1C8799D039A80BAD6BB0562E48EA5AF6B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:..P.&................environment."production".Oq.a................topSitesJ[{"title":"Security & Privacy","url":"secure://security-privacy-center/"}]..sf'................isAdblockStrictMode.falseApV.1................trackingParams..{"_":"1717427791864","browser_language":"en-GB","browser_name":"AVG Secure Browser","browser_version":"124.0.25069.209","browser_version_initial":"124.0.25069.209","build_timestamp":"1715185684","campaign_group_id":"100","campaign_id":"9249","chrome_brand":"ONGR","default_browser":"avg","default_browser_version":"124.0.25069.209","group":{"browser":{"architecture":"x64","last_search_timestamp":"0"},"environment":{"midex":"1F2CCAD3812656C4930608337C4FB4A54E940D68C5EAC26B43330382030DCCD2"}},"initial_country_code":"US","initial_default_browser":"chrome","initial_default_browser_version":"117.0.5938.132","install_admin":"1","install_date":"20240603","install_timestamp":"1717427701","installer_version":"8.11.8.7421","last_run_timestamp":"0","machine_date":"202406

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Local Extension Settings\jfijboeaeajnoejbcdbhejlnmhepeige\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Local Extension Settings\jfijboeaeajnoejbcdbhejlnmhepeige\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):359
                                                                                                                                                              Entropy (8bit):5.216314292632339
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:86042F43DEB972240EDFE1B0CB568A0D
                                                                                                                                                              SHA1:09634F5D20B4B026243E336A07A67FF0EAFCF6AC
                                                                                                                                                              SHA-256:9F4174BC93DCE94DEBE6804F3AA06B213C876E6C53A210EA5CA89D7A6972B10A
                                                                                                                                                              SHA-512:2BDEAF3024C779209156A2771C8126DD1FE97BCECC4D421D6B079573CDEE969E5F3766BBE84B6AA51DFE2BD06C8B482DE9A2F384E063147416580DD5DA136627
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:2024/06/03-11:16:31.084 dd0 Creating DB C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Local Extension Settings\jfijboeaeajnoejbcdbhejlnmhepeige since it was missing..2024/06/03-11:16:31.503 dd0 Reusing MANIFEST C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Local Extension Settings\jfijboeaeajnoejbcdbhejlnmhepeige/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Local Extension Settings\jfijboeaeajnoejbcdbhejlnmhepeige\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Local Storage\leveldb\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Local Storage\leveldb\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Local Storage\leveldb\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):289
                                                                                                                                                              Entropy (8bit):5.209005438233992
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F2CDBA349FC2A8FDF1A72184056CC927
                                                                                                                                                              SHA1:8ADBCF1787CE2D46D9D013B1F86624D90B5D9018
                                                                                                                                                              SHA-256:B83F0B2B1F16918DC790C8DB243AF8E38F85A27D401794EF1BF38D67A57619F7
                                                                                                                                                              SHA-512:A28A9311F4D93AEC064CFE8D8BFB71C4AA65FF2539D8EE83C45C9CE38C432BDDB42F76F28D9F92B443D9828A991FE67237810D5293F6839AAE825F4B60DDBCAD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:2024/06/03-11:16:30.823 1588 Creating DB C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Local Storage\leveldb since it was missing..2024/06/03-11:16:31.115 1588 Reusing MANIFEST C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Local Storage\leveldb/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Local Storage\leveldb\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Login Data

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045001, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):40960
                                                                                                                                                              Entropy (8bit):0.8621516222976348
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:6EDCEE50C30F90C2CF65EB05BE6EFBF8
                                                                                                                                                              SHA1:F661C53AECFC5F67D2DA7FEF4147ADCD3B0B5AD4
                                                                                                                                                              SHA-256:53F55645EDA206ACE58251A76ECEF177883FA59D5FA03A5C7B89810B8B2DC06B
                                                                                                                                                              SHA-512:61B5864A5C199950CA8B9F8E3CF9C244D943B9321CA5C6D9016E79E1030FD09E57E3C030A5BFF5207E8ED56D8CD67FE59975666B41765C82AA0B282CE3C8C87B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................v.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Login Data For Account

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045001, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):40960
                                                                                                                                                              Entropy (8bit):0.8621516222976348
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:6EDCEE50C30F90C2CF65EB05BE6EFBF8
                                                                                                                                                              SHA1:F661C53AECFC5F67D2DA7FEF4147ADCD3B0B5AD4
                                                                                                                                                              SHA-256:53F55645EDA206ACE58251A76ECEF177883FA59D5FA03A5C7B89810B8B2DC06B
                                                                                                                                                              SHA-512:61B5864A5C199950CA8B9F8E3CF9C244D943B9321CA5C6D9016E79E1030FD09E57E3C030A5BFF5207E8ED56D8CD67FE59975666B41765C82AA0B282CE3C8C87B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................v.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Preferences

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3789
                                                                                                                                                              Entropy (8bit):4.886792398456485
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:2ABAC7B82BC2094C2123C85109D0924E
                                                                                                                                                              SHA1:2174BA46FCF88D48AE1BA0AF3A7AA91894BA433D
                                                                                                                                                              SHA-256:79ECA204D5B96029792C67F05AB0FEB43EE1C09160F3831014E2B91D10A2270C
                                                                                                                                                              SHA-512:FF64E986125609D9D28C641C0F645ECECEAA54A8D2A3C680B43EA207ED23FDCCE7C8DF3B9E1BCB011E990FA0B09581DF506A91A0614A46F397015AB580FE2323
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{.. "bookmark_bar": {.. "show_apps_shortcut": true,.. "show_on_all_tabs": true.. },.. "browser": {.. "show_home_button": false.. },.. "distribution": {.. "features": {.. },.. "import_bookmarks_from_file": "master_bookmarks.html",.. "import_from_browser": 7,.. "is_imported_browser_default": true.. },.. "enable_do_not_track": true,.. "extensions": {.. "management": {.. "*": {.. "install_sources": [ ].. }.. }.. },.. "first_run_tabs": [ "http://new_tab_page" ],.. "import_autofill_form_data": true,.. "import_bookmarks": true,.. "import_cookies": true,.. "import_history": true,.. "import_saved_passwords": true,.. "protection": {.. "macs": {.. "adblock": {.. "last_used_schema_version": "4492DA98BC4AF91F0F57F138B947D60F05A7FD8E4C43F5B43E055CABE37343D8".. },.. "browser": {.. "show_home_button": "7E99030D80842F6B31CFF7A701F51FDDE0C2D401D

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Preferences~RF5e6dd4.TMP (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3789
                                                                                                                                                              Entropy (8bit):4.886792398456485
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:2ABAC7B82BC2094C2123C85109D0924E
                                                                                                                                                              SHA1:2174BA46FCF88D48AE1BA0AF3A7AA91894BA433D
                                                                                                                                                              SHA-256:79ECA204D5B96029792C67F05AB0FEB43EE1C09160F3831014E2B91D10A2270C
                                                                                                                                                              SHA-512:FF64E986125609D9D28C641C0F645ECECEAA54A8D2A3C680B43EA207ED23FDCCE7C8DF3B9E1BCB011E990FA0B09581DF506A91A0614A46F397015AB580FE2323
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{.. "bookmark_bar": {.. "show_apps_shortcut": true,.. "show_on_all_tabs": true.. },.. "browser": {.. "show_home_button": false.. },.. "distribution": {.. "features": {.. },.. "import_bookmarks_from_file": "master_bookmarks.html",.. "import_from_browser": 7,.. "is_imported_browser_default": true.. },.. "enable_do_not_track": true,.. "extensions": {.. "management": {.. "*": {.. "install_sources": [ ].. }.. }.. },.. "first_run_tabs": [ "http://new_tab_page" ],.. "import_autofill_form_data": true,.. "import_bookmarks": true,.. "import_cookies": true,.. "import_history": true,.. "import_saved_passwords": true,.. "protection": {.. "macs": {.. "adblock": {.. "last_used_schema_version": "4492DA98BC4AF91F0F57F138B947D60F05A7FD8E4C43F5B43E055CABE37343D8".. },.. "browser": {.. "show_home_button": "7E99030D80842F6B31CFF7A701F51FDDE0C2D401D

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Secure Preferences (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):11041
                                                                                                                                                              Entropy (8bit):5.568436236685337
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:B7863800FCFE797C052BE215ECD86ED3
                                                                                                                                                              SHA1:AB539DB2C518D3AE4311C37CC36E567D8305F402
                                                                                                                                                              SHA-256:89BF877328D13A146C13F7AA85D7E5DA472A398E02533B2DE09699189D42CD3B
                                                                                                                                                              SHA-512:732579321BBC36D378D32FEA359D75772E1FB54398EE7120ED02C746C74BFA69EA39A89D75E35547981DB51B9ED225446ED27CC84D2986FC874D89195AF7BD3C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"browser":{"show_home_button":false},"enable_do_not_track":true,"extensions":{"install":{"denylist":["*"]},"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13361901388151306","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13361901388151306","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore","https://addons.avast.com/","https://addons.avg.com/","https://addons.ccleaner.com/","https://addons.avast.securebrowser.com","https://addons.avg.securebrowser.com","https://addons.ccleaner.securebrowser.com","https://addons.avira.securebrowser.com","https://addons.norton.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Session Storage\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Session Storage\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Session Storage\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):277
                                                                                                                                                              Entropy (8bit):5.164862354910651
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:8599EB4DF94893CD16D7AD0C151C1BFC
                                                                                                                                                              SHA1:B5951B5DE9DFA5232A38B1CC5CE6663A82E2921E
                                                                                                                                                              SHA-256:75C8996E6842297C18EE3AA74AF0E3BCE7D3AFC57BC07ABF027407F5A1E66D2E
                                                                                                                                                              SHA-512:27007C7A497E16CA2A8644FB18644651D93826BA1B575123AEA1C7693D702D1020B92513BD08941045BE82F3AAD4D4C8FE64A9B57EA728B9C059DFA202679667
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:2024/06/03-11:16:33.669 1588 Creating DB C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Session Storage since it was missing..2024/06/03-11:16:33.828 1588 Reusing MANIFEST C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Session Storage/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Session Storage\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Site Characteristics Database\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Site Characteristics Database\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):40
                                                                                                                                                              Entropy (8bit):3.473726825238924
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:148079685E25097536785F4536AF014B
                                                                                                                                                              SHA1:C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
                                                                                                                                                              SHA-256:F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
                                                                                                                                                              SHA-512:C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.On.!................database_metadata.1

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Site Characteristics Database\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Site Characteristics Database\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):303
                                                                                                                                                              Entropy (8bit):5.100686221044127
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CAC3495FB06A8B23C71E6A51CCC7303D
                                                                                                                                                              SHA1:B9A94B45961C41059D669040F4F99CFA872B171B
                                                                                                                                                              SHA-256:907DDFA9455EA1EE424E118D4D479F494B9359DB926D1CC07128DF88B73AECFA
                                                                                                                                                              SHA-512:6EF3E9C5C1B4BF9FC7B609335990F319AF276C142CE1E143629507847352E06FF4DBCC87C191AE9C79FB6632BEFBFFB808949EA5A18E87600A2147B3E6D36AE6
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:2024/06/03-11:16:28.028 dd0 Creating DB C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Site Characteristics Database since it was missing..2024/06/03-11:16:28.068 dd0 Reusing MANIFEST C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Site Characteristics Database/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Site Characteristics Database\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Sync Data\LevelDB\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Sync Data\LevelDB\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46
                                                                                                                                                              Entropy (8bit):4.019797536844534
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:90881C9C26F29FCA29815A08BA858544
                                                                                                                                                              SHA1:06FEE974987B91D82C2839A4BB12991FA99E1BDD
                                                                                                                                                              SHA-256:A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
                                                                                                                                                              SHA-512:15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:...n'................_mts_schema_descriptor...

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Sync Data\LevelDB\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Sync Data\LevelDB\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):281
                                                                                                                                                              Entropy (8bit):5.210025213307973
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5C00001AF7020B8BA68C52FE9D15CC58
                                                                                                                                                              SHA1:F5352AEDE4582FD6DE888549AE9D0D857795E856
                                                                                                                                                              SHA-256:4B463E0008FF15489D7AF95FA4180AAD7399F7ED9B74E391B092CB655EF540A5
                                                                                                                                                              SHA-512:C04BE7217E834190638CCBBC5AD8C4D5B6BC4E0E80815CE315BCF9EEA13D6EA7B4F02CBFEFBE421E22E22873C4B1D7516DA2E5DD4442F4D070E1958C36EECE20
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:2024/06/03-11:16:28.018 19e4 Creating DB C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Sync Data\LevelDB since it was missing..2024/06/03-11:16:28.075 19e4 Reusing MANIFEST C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Sync Data\LevelDB\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Top Sites

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045001, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20480
                                                                                                                                                              Entropy (8bit):0.36785910495443114
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CF2A8082F5B870F9D33DC6A8F7F2B2F8
                                                                                                                                                              SHA1:94BE32B91C123D7864B1E44FA351B940111B1366
                                                                                                                                                              SHA-256:B2502A114BEBC1036CAF47434DB4B3FA353B3730583892680B217F85C6F48A65
                                                                                                                                                              SHA-512:D1BC212BE94465A44DDF45DB75EC8028B2628E27F4F7F471B548A7946CCD99CEEF2A7CDDE9C240BA5CB47A72512D3A9C2C1DC6661A319E939F287690E380681C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................v..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Visited Links

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):131072
                                                                                                                                                              Entropy (8bit):0.002110589502647469
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:C81FA450CFD0093C1C2C7A511DA558CE
                                                                                                                                                              SHA1:91A7F3E6025E2BEC1359930F6BE30CF8CBF363AC
                                                                                                                                                              SHA-256:1B3C7E616850140780F1BABE49334EBF52BB2C63B6CBFBB3EC907EED85C1B631
                                                                                                                                                              SHA-512:D02D8A0E21224F59EEDD953F514138AA271E136084756248126A2B90F1E22D3BBC7718AD69B20B87E2400FF5DCF311795D199E433E9B653F2506D48F95E56EFE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:VLnk.....?........t4.3.K................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\Web Data

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045001, page size 2048, file counter 3, database pages 62, cookie 0x26, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):126976
                                                                                                                                                              Entropy (8bit):1.1535451180871674
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:18989307369ADD4D3C2FA805F8E97F9A
                                                                                                                                                              SHA1:7BFB39725AE43134408644645F63262C97F4F66F
                                                                                                                                                              SHA-256:7F95C84A2DF5E7372050D6E1CAFA277A0E7C24EE8BF3F1600FF5C54557D4ACE8
                                                                                                                                                              SHA-512:46C815679CFC4E7FEF8507BECD7636C428510266A993C7ABE08D9DF045CD0D32AB23D1E6F3384E040F9A392D7035AD3C358EBD2B0227E5787746EBD8D947E528
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:SQLite format 3......@ .......>...........&......................................................v............<........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\heavy_ad_intervention_opt_out.db

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045001, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16384
                                                                                                                                                              Entropy (8bit):0.3519250993311556
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:66B4DF4B40367E4E94BAD913AD0B265F
                                                                                                                                                              SHA1:7485848D15F64E6DB07FD64FEC0E8C266FB0736D
                                                                                                                                                              SHA-256:496534AE3B7E7B40808B4EE21051C47EAD03D4CF9C393A9C394EE2477935C86E
                                                                                                                                                              SHA-512:733CE3C209B626F678121E9F9F3FEBB8A1F583D49FB35CA6A6DF1F5408EB207E3F7C7C92883F6D2546451453DC49B10683519AE16F6C36582A8FF28D89EC6A05
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................v.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\shared_proto_db\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\shared_proto_db\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4934
                                                                                                                                                              Entropy (8bit):6.795569063294468
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:C103E4E2BE613C3E79B80CA0D816C768
                                                                                                                                                              SHA1:BB8E958CE8E05ABFFE284683BFB693FC32F31DBA
                                                                                                                                                              SHA-256:66BC7CFE7D70BBA303878868DACCF2705F35EB2DC58A01496F83DEF3D9CD6598
                                                                                                                                                              SHA-512:6C0D273232BFC8A7527C6659CC01870D7B53A66A592C3B10DF70F20D49A8D30AA7FA17B11B7EB31CC14CD51D6242A72D9036B0D6ED16F49CEE60AB64B2DD50B1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview::....................37_DEFAULT_16v...h.... .(.0.R*.(....Session.TotalDuration.T<.A..GO .(.0.../.'.%....?..ChromeLowUserEngagement..Other...... .(...10......................37_DEFAULT_21........... .(.0.RZ.X...CCommerce.PriceDrops.ActiveTabNavigationComplete.IsProductDetailPage.w.cG$.. .(.0.8.R9.7...$Autofill_PolledCreditCardSuggestions...c..vP. .(.0...$........?..ShoppingUser..Other...... .(...10..J.. ................37_DEFAULT_23........... .(.0.RH.F...1Omnibox.SuggestionUsed.ClientSummarizedResultType.q/.v.g:` .(.0.8.Ra._.DSELECT COUNT(id) FROM metrics WHERE metric_hash = '64BD7CCE5A95BF00'......................dh...8.0........?..Low......@..Medium......A..High..None...... .(...10...:..................37_DEFAULT_27........... .(.0.R=.;...."%..wait_for_device_info_in_seconds..60*.SyncDeviceInfoh.p...t.r.p....AndroidPhone..IosPhoneChrome..AndroidTablet..IosTablet..Desktop..Other..SyncedAndFirstDevice..NotSynced....= .(...10....M.................37_DEFAULT_32.`c.6...............

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\shared_proto_db\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\shared_proto_db\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):277
                                                                                                                                                              Entropy (8bit):5.279538114426147
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:57F16450F2D016060C44CE48D38C2F62
                                                                                                                                                              SHA1:42DDFEBA23A5DE0B2D11EECA01DC7ACD313A4A4C
                                                                                                                                                              SHA-256:183098281DF99FB5AC8209BB56D0C1AEE12E2A936ABFCE3D594397A2844A5E32
                                                                                                                                                              SHA-512:E7A22978071F74A761F44832B66342A3A50306F7731B21A563217F27F6E51E2BCF375D8D6017D85D9DB99FB985147C557C0015EF2B300C9BAF3037A2027293DB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:2024/06/03-11:16:28.704 192c Creating DB C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\shared_proto_db since it was missing..2024/06/03-11:16:28.747 192c Reusing MANIFEST C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\shared_proto_db/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\shared_proto_db\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\shared_proto_db\metadata\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\shared_proto_db\metadata\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):532
                                                                                                                                                              Entropy (8bit):3.911346606993188
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:FF71391F67906236916B66F1A402BEC9
                                                                                                                                                              SHA1:C0FEEE9388272689C414BB2157EF59BE4B33826C
                                                                                                                                                              SHA-256:22CE4D11880DF9D960BD5B160CC26BCA8B42BC76452A8479BB26B87EABE55FC9
                                                                                                                                                              SHA-512:B3DD263D05B501EAC4EFE36927D9076453434A83FF757C72D323F7E2A0D6B8201C57039A0F98C1EB22C8D69ED402956FD79C6CC023BA7B07A878F9EEA6B389C8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.h.6.................__global... .t...................__global... ...w.................44_.....a....................48_........?.................33_........[.................49_.....:.'..................21_......E...................37_.....`0M..................38_......Hf..................39_.........................44_..........................49_......~z..................21_..........................37_.....W%..................38_.....s...................39_.......-8.................48_.....s....................33_.....

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\shared_proto_db\metadata\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):295
                                                                                                                                                              Entropy (8bit):5.234165403685916
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:6AE6049B13126F52665F2DE224D0ACA0
                                                                                                                                                              SHA1:A17555255C6364AC023AEA74FD27698C90056F7F
                                                                                                                                                              SHA-256:4B8FD6E12F2632C081402431E90C708EA6ED0AFEFCACDB7DBD088DC0836B853C
                                                                                                                                                              SHA-512:C0484D0ABC9219B91368B021661447953130A37DDABA2AFA15103B4FCD28826C0268086DEA267CED8FBF9574DF90A1C68D590E895110ED721764681BFF5A4A05
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:2024/06/03-11:16:28.581 192c Creating DB C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\shared_proto_db\metadata since it was missing..2024/06/03-11:16:28.664 192c Reusing MANIFEST C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\GrShaderCache\data_0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.01057775872642915
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\GrShaderCache\data_1

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):270336
                                                                                                                                                              Entropy (8bit):0.0012471779557650352
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                                                                                                              SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                                                                                                              SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                                                                                                              SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\GrShaderCache\data_2

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.011852361981932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\GrShaderCache\data_3

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.012340643231932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\GrShaderCache\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):262512
                                                                                                                                                              Entropy (8bit):9.553120663130604E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:1AF9A66EABE253463C5DA68E5A27B58C
                                                                                                                                                              SHA1:A94C0BFB648841053FC9D1539FFB4FCE492DECFA
                                                                                                                                                              SHA-256:5B88BEE9E8AB83D7C6B2C9592CE9AAB6A90D9CE865FE10C152DC650530FD8B6C
                                                                                                                                                              SHA-512:12806EA54C58C8EF0F777F6D394B16E47BEC3A08D7A0AE0F4F3D23AEF5B658C045503B789624A3B6B57EA80CCAC2DE8183588120169569651D5F9896069218E4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................C....x/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\GraphiteDawnCache\data_0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.01057775872642915
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\GraphiteDawnCache\data_1

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):270336
                                                                                                                                                              Entropy (8bit):0.0012471779557650352
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                                                                                                              SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                                                                                                              SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                                                                                                              SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\GraphiteDawnCache\data_2

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.011852361981932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\GraphiteDawnCache\data_3

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.012340643231932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\GraphiteDawnCache\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):262512
                                                                                                                                                              Entropy (8bit):9.553120663130604E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:534179F1E184B0B2E362B734B0D6F68F
                                                                                                                                                              SHA1:575ADE198E1E2BA18F1160E09241E947D9AD39FD
                                                                                                                                                              SHA-256:1975333099D589E1DC3817927D4BA65AA095BCC38FAD8FC39D5AAFB1092D4070
                                                                                                                                                              SHA-512:4B231781341109904EF627D1ED29B7504AC47E6829AA40B14081FCCCD654589EF37081CA681B889B50F4715E4249AA1598F055DF2149DA62A7B8AA7110990B88
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.........................................^...x/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Last Version

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text, with no line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):15
                                                                                                                                                              Entropy (8bit):2.8225797618424915
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CDFC009DAC6840171C12D4DDAE663F2B
                                                                                                                                                              SHA1:5CB1524BF84F0ECACD2E8AE3E33B88A2FF8A0244
                                                                                                                                                              SHA-256:3F348798FF1C2D399DCF12D23FC931F6F2EDFC89C3DE45950860E9CAA004E596
                                                                                                                                                              SHA-512:31A340D735CB3375D16970A1323D568D526326747BF58A9B65166DCEDEC4022565DAF75AAD28D129DC998304CEC58F8BC73E728CE1434F27794B0177082202A1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:124.0.25069.209

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Local State (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1173
                                                                                                                                                              Entropy (8bit):5.662743453033679
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:12A66DEDFE178D9DCE0F451B2AF7507F
                                                                                                                                                              SHA1:46E906B44712C808F0AF2C59262C995A0BEB1D54
                                                                                                                                                              SHA-256:E58186765B277175E81445A35A23D2C272AA0C8BC7337C0A5EE026A966795842
                                                                                                                                                              SHA-512:ED31BD1F2F02E5DAF2C0BDF0F9A9521A43BDC7D53BFD2AAF1D47377C041D87792226555CB1CAA1276510E6E60822CDB7E151F044BE64E27CBACEA4DC726CD690
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"intl":{"app_locale":"en-GB"},"last_run_browser_version":"124.0.25069.209","legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACav1wecwIDRry5+jIjHRY/EAAAACYAAABBAFYARwAgAFMAZQBjAHUAcgBlACAAQgByAG8AdwBzAGUAcgAAABBmAAAAAQAAIAAAADuJN1s+/I/pAwKKrItjbE6W+XQL6FSveMylIuKSDSP5AAAAAA6AAAAAAgAAIAAAAOvrXpfAt0ShULU7ENCevGa7K0QQHTv+ghyJRvcGjb1RMAAAAMTL6jcttOyPMWo7QN95ZiduFDePVuu/LDs9bKEga423QC1yhosLpGzjWP1E3GyhOEAAAADfVyx1aDMJT8VwSfLDdQSCmorzei3hD4OSzOMZOnUcS4vhJyaN+JoRUDnRS3ewT+1umPxJewM5aB/YoDI97Pru"},"pending_first_run_tabs":["http://new_tab_page"],"profile":{"info_cache":{},"profile_counts_reported":"13361901387188812","profiles_order":[]},"uninstall_metrics":{"installation_date2":"1717427782"},"user_experience_metrics":{"client_id2":"d82d3385-2397-4aa1-82e7-21233bb91a09","client_id_timestamp":"1717427782","low_entropy_source3":7443,"pseudo_low_entropy_source":365,"stability":{"browser_last_live_timestamp":"133

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Local State~RF5e6c7c.TMP (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1173
                                                                                                                                                              Entropy (8bit):5.662743453033679
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:12A66DEDFE178D9DCE0F451B2AF7507F
                                                                                                                                                              SHA1:46E906B44712C808F0AF2C59262C995A0BEB1D54
                                                                                                                                                              SHA-256:E58186765B277175E81445A35A23D2C272AA0C8BC7337C0A5EE026A966795842
                                                                                                                                                              SHA-512:ED31BD1F2F02E5DAF2C0BDF0F9A9521A43BDC7D53BFD2AAF1D47377C041D87792226555CB1CAA1276510E6E60822CDB7E151F044BE64E27CBACEA4DC726CD690
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"intl":{"app_locale":"en-GB"},"last_run_browser_version":"124.0.25069.209","legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACav1wecwIDRry5+jIjHRY/EAAAACYAAABBAFYARwAgAFMAZQBjAHUAcgBlACAAQgByAG8AdwBzAGUAcgAAABBmAAAAAQAAIAAAADuJN1s+/I/pAwKKrItjbE6W+XQL6FSveMylIuKSDSP5AAAAAA6AAAAAAgAAIAAAAOvrXpfAt0ShULU7ENCevGa7K0QQHTv+ghyJRvcGjb1RMAAAAMTL6jcttOyPMWo7QN95ZiduFDePVuu/LDs9bKEga423QC1yhosLpGzjWP1E3GyhOEAAAADfVyx1aDMJT8VwSfLDdQSCmorzei3hD4OSzOMZOnUcS4vhJyaN+JoRUDnRS3ewT+1umPxJewM5aB/YoDI97Pru"},"pending_first_run_tabs":["http://new_tab_page"],"profile":{"info_cache":{},"profile_counts_reported":"13361901387188812","profiles_order":[]},"uninstall_metrics":{"installation_date2":"1717427782"},"user_experience_metrics":{"client_id2":"d82d3385-2397-4aa1-82e7-21233bb91a09","client_id_timestamp":"1717427782","low_entropy_source3":7443,"pseudo_low_entropy_source":365,"stability":{"browser_last_live_timestamp":"133

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Local State~RF5e6d76.TMP (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1173
                                                                                                                                                              Entropy (8bit):5.662743453033679
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:12A66DEDFE178D9DCE0F451B2AF7507F
                                                                                                                                                              SHA1:46E906B44712C808F0AF2C59262C995A0BEB1D54
                                                                                                                                                              SHA-256:E58186765B277175E81445A35A23D2C272AA0C8BC7337C0A5EE026A966795842
                                                                                                                                                              SHA-512:ED31BD1F2F02E5DAF2C0BDF0F9A9521A43BDC7D53BFD2AAF1D47377C041D87792226555CB1CAA1276510E6E60822CDB7E151F044BE64E27CBACEA4DC726CD690
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"intl":{"app_locale":"en-GB"},"last_run_browser_version":"124.0.25069.209","legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACav1wecwIDRry5+jIjHRY/EAAAACYAAABBAFYARwAgAFMAZQBjAHUAcgBlACAAQgByAG8AdwBzAGUAcgAAABBmAAAAAQAAIAAAADuJN1s+/I/pAwKKrItjbE6W+XQL6FSveMylIuKSDSP5AAAAAA6AAAAAAgAAIAAAAOvrXpfAt0ShULU7ENCevGa7K0QQHTv+ghyJRvcGjb1RMAAAAMTL6jcttOyPMWo7QN95ZiduFDePVuu/LDs9bKEga423QC1yhosLpGzjWP1E3GyhOEAAAADfVyx1aDMJT8VwSfLDdQSCmorzei3hD4OSzOMZOnUcS4vhJyaN+JoRUDnRS3ewT+1umPxJewM5aB/YoDI97Pru"},"pending_first_run_tabs":["http://new_tab_page"],"profile":{"info_cache":{},"profile_counts_reported":"13361901387188812","profiles_order":[]},"uninstall_metrics":{"installation_date2":"1717427782"},"user_experience_metrics":{"client_id2":"d82d3385-2397-4aa1-82e7-21233bb91a09","client_id_timestamp":"1717427782","low_entropy_source3":7443,"pseudo_low_entropy_source":365,"stability":{"browser_last_live_timestamp":"133

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\ShaderCache\data_0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.01057775872642915
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\ShaderCache\data_1

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):270336
                                                                                                                                                              Entropy (8bit):0.0012471779557650352
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                                                                                                              SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                                                                                                              SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                                                                                                              SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\ShaderCache\data_2

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.011852361981932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\ShaderCache\data_3

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.012340643231932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\ShaderCache\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):262512
                                                                                                                                                              Entropy (8bit):9.553120663130604E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F4E29A59E7CDE7A0F2EE0FE2C1DDB30D
                                                                                                                                                              SHA1:E6E7AEC14E888F440D82FD84179FEF148F113668
                                                                                                                                                              SHA-256:E1F38DF3DF808E883D9B65DD852BAC10C903F534C816A203A6A6A768EDAF9E60
                                                                                                                                                              SHA-512:324895AD468877061D2AF153DF3BF25C4A7E74A3EE5E46CC765C5D6AB0A0021B75D53F38F995A04C5B543BED137B422E9983B01CA0A7CA21AD657C079EBF5C16
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................y<...x/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\Variations

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):85
                                                                                                                                                              Entropy (8bit):4.3488360343066725
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:BC6142469CD7DADF107BE9AD87EA4753
                                                                                                                                                              SHA1:72A9AA05003FAB742B0E4DC4C5D9EDA6B9F7565C
                                                                                                                                                              SHA-256:B26DA4F8C7E283AA74386DA0229D66AF14A37986B8CA828E054FC932F68DD557
                                                                                                                                                              SHA-512:47D1A67A16F5DC6D50556C5296E65918F0A2FCAD0E8CEE5795B100FE8CD89EAF5E1FD67691E8A57AF3677883A5D8F104723B1901D11845B286474C8AC56F6182
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":0}

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\c1eb2b18-bd12-4471-91b2-4c29395fce70.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1173
                                                                                                                                                              Entropy (8bit):5.662743453033679
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:12A66DEDFE178D9DCE0F451B2AF7507F
                                                                                                                                                              SHA1:46E906B44712C808F0AF2C59262C995A0BEB1D54
                                                                                                                                                              SHA-256:E58186765B277175E81445A35A23D2C272AA0C8BC7337C0A5EE026A966795842
                                                                                                                                                              SHA-512:ED31BD1F2F02E5DAF2C0BDF0F9A9521A43BDC7D53BFD2AAF1D47377C041D87792226555CB1CAA1276510E6E60822CDB7E151F044BE64E27CBACEA4DC726CD690
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"intl":{"app_locale":"en-GB"},"last_run_browser_version":"124.0.25069.209","legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACav1wecwIDRry5+jIjHRY/EAAAACYAAABBAFYARwAgAFMAZQBjAHUAcgBlACAAQgByAG8AdwBzAGUAcgAAABBmAAAAAQAAIAAAADuJN1s+/I/pAwKKrItjbE6W+XQL6FSveMylIuKSDSP5AAAAAA6AAAAAAgAAIAAAAOvrXpfAt0ShULU7ENCevGa7K0QQHTv+ghyJRvcGjb1RMAAAAMTL6jcttOyPMWo7QN95ZiduFDePVuu/LDs9bKEga423QC1yhosLpGzjWP1E3GyhOEAAAADfVyx1aDMJT8VwSfLDdQSCmorzei3hD4OSzOMZOnUcS4vhJyaN+JoRUDnRS3ewT+1umPxJewM5aB/YoDI97Pru"},"pending_first_run_tabs":["http://new_tab_page"],"profile":{"info_cache":{},"profile_counts_reported":"13361901387188812","profiles_order":[]},"uninstall_metrics":{"installation_date2":"1717427782"},"user_experience_metrics":{"client_id2":"d82d3385-2397-4aa1-82e7-21233bb91a09","client_id_timestamp":"1717427782","low_entropy_source3":7443,"pseudo_low_entropy_source":365,"stability":{"browser_last_live_timestamp":"133

                                                                                                                                                              C:\Users\user\AppData\Local\AVG\Browser\User Data\segmentation_platform\ukm_db

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045001, file counter 11, database pages 12, cookie 0xb, schema 4, UTF-8, version-valid-for 11
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):49152
                                                                                                                                                              Entropy (8bit):0.37323556012560016
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:8A598D49D6529F9B8482A7D3D794767B
                                                                                                                                                              SHA1:488F157C512003BA2BDCB9619FD401624900B87C
                                                                                                                                                              SHA-256:25E335A8D294D1954DBBC5C5D14922460816FE3B89B3907C4FC1204DF721BE96
                                                                                                                                                              SHA-512:766DB6EE41794B96002BA4534B3B5917AA52159E8FAB8A5830D9906EDC0243DEC60F5F8D8E1C05077F83903FE98FB9786F27F285E2FB650E7C02068FD87DD59F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................v.......<..........x.....j.....<......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\377cc4f8-0c1a-49d4-a7d3-dc885f2ebb50.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:very short file (no magic)
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1
                                                                                                                                                              Entropy (8bit):0.0
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:3389DAE361AF79B04C9C8E7057F60CC6
                                                                                                                                                              SHA1:DF58248C414F342C81E056B40BEE12D17A08BF61
                                                                                                                                                              SHA-256:684888C0EBB17F374298B65EE2807526C066094C701BCC7EBBE1C1095F494FC1
                                                                                                                                                              SHA-512:7846CDD4C2B9052768B8901640122E5282E0B833A6A58312A7763472D448EE23781C7F08D90793FDFE71FFE74238CF6E4AA778CC9BB8CEC03EA7268D4893A502
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:*

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\2a9c6051-23cc-4762-8af0-814840b8210d.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):9120
                                                                                                                                                              Entropy (8bit):5.857505323097346
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F34A8ACDBD3B58A144B51266134BF810
                                                                                                                                                              SHA1:E015CABF5BCE09B2615C2E4F0FCF4C16264F9606
                                                                                                                                                              SHA-256:E3D7AA8B63B0E1C8BB1D4DF8956B9F76B837BE8B43BE7FECA92DAD0D740C8CEF
                                                                                                                                                              SHA-512:0ADB13F8AEFC29FA550E19B1711E2BC5419F40B4FBE7C3E5B5FC8D69BD86077D0DECA4C6FCE2F7D4559CD0D552DC1A7F2A9FAE1D1C9F40A6C7CD422A09C7A23F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"autolaunch":{"engagement_count":-1,"id":"422","restore_tabs":false,"show_infobar_count":-2,"show_ntp":false,"skip_infobar_count":1,"start_maximized":false,"state":3,"timestamp":1643760000},"background_mode":1,"breadcrumbs":{"enabled":false,"enabled_time":"13361901384109870"},"engagement":{"changed_by_user":{"background_mode":false,"search":{"search_provider_partner_override_id":false}},"forced_pref_timestamp":{"search":{"search_provider_partner_override_id":1713542100}}},"hardware_acceleration_mode_previous":true,"latest_experiments_overrides":["EnableTabMuting","browserProtect","BrowserPro","AvastVPN","BackgroundImages","PhalanxContentScanning","InterpolateGoogleTiles","NtpExtension","ReplaceUserAgent","first-search-omnibox","GpuSpoofProcessName","PhalanxJavaScriptScriptsScanning","RedesignedClose"],"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"optimization_guide":{"model_store_metadata":{}},"os_crypt":

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\9ccecf92-f959-4019-ac58-107040a08171.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):907
                                                                                                                                                              Entropy (8bit):5.685431940949326
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:258FDD328BAC516333C5B75FF21D962C
                                                                                                                                                              SHA1:3368BC2B730701C23C3EFDE6487E0ED7116A27A5
                                                                                                                                                              SHA-256:3CA67F745ADC0DCEBE2189C9893A2CE8E33B9FEC36DD3434DCEDE110DE6C0842
                                                                                                                                                              SHA-512:D1C068935AF1F386A93335660625C7AD4C5B929FF5E12F98D8C6F7F15320006FFB91EA738379A1E1A6D73D08386DCAA5EFBECD5F34B0D878F0C4B31BA494B8C2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACav1wecwIDRry5+jIjHRY/EAAAACYAAABBAFYARwAgAFMAZQBjAHUAcgBlACAAQgByAG8AdwBzAGUAcgAAABBmAAAAAQAAIAAAAP/RXqBftAXnys960kUQTnf/juZXCU0rW5z9ciUZC5jHAAAAAA6AAAAAAgAAIAAAAM1AgjmloZG8gsuIRYQP86F4NKSVbyBP3eUnfQH4r1DaMAAAAJGBTLuBcpC0II+sdlfNb2RGQe2N2xyl7tvstOYP0Ixk9b89fj5EqflFI9NE8M0VlUAAAAB/lxJ32Shv+gL/chBRy3a9/WXRBHtzPGGde31ScmDBwhKlu08vwAnc4tnRCN/lPHY1v1fEuAHT/AV6K4pdHoMZ"},"uninstall_metrics":{"installation_date2":"1717427782"},"user_experience_metrics":{"client_id2":"5e90899e-4d46-4a05-b033-6fcfa6333da5","client_id_timestamp":"1717427782","low_entropy_source3":932,"pseudo_low_entropy_source":1334,"stability":{"browser_last_live_timestamp":"13361901382363150","stats_buildtime":"1715185684","stats_version":"124.0.25069.209-64-devel","system_crash_count":0}},"variations_limited_entropy_synthetic_trial_seed_v2":"70"}

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\BrowserMetrics\BrowserMetrics-665DDE46-1FAC.pma

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4194304
                                                                                                                                                              Entropy (8bit):0.2716295095038675
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:9B8C33CA7B35B0BD58045931F590DDBA
                                                                                                                                                              SHA1:F20D2B4A9F7C6F94E1AD7EE07176447670CAFE6C
                                                                                                                                                              SHA-256:3213AC961F54CFF45163FB94BC6AE0DCBD7B94126BA9AACD3C952C2F277B88EC
                                                                                                                                                              SHA-512:C73EBC035D5110A702882CA8CC0AA3BFA9C3899A41498DF6171CCEF3DC19D9E9B3CB58EF0757C1EA1040DE05D4579FCDDF1A682630890CBC112A5174650E91D5
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:...@..@...@.....C.].....@...............x...................`... ...i.y.........BrowserMetrics......i.y..Yd.........A.......d...2......._.z.....Gy.7....................Gy.7....................UMA.PersistentAllocator.EarlyHistograms.BrowserMetrics......i.y.["......................................................................................................................... ..."...$...&...(...*...-...0...3...6...9...<...@...D...H...L...P...U...Z..._...d...............i.y..Yd........A...............`...v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.3...............124.0.25069.209-64-devel".en-GB*...Windows NT..10.0.190452(..x86_64..?.......".tqvqdc20,1...x86_64J..X.*..D...J..m#:^....AP.........................L..H...,...CookieDeprecationFacilitatedTestingLabelOnly....LabelOnly1_20240207..<..8...(...SyntheticOptimizationGuideRemoteFetching....Disabled.$.. .......CPSS

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\3ff74eef-5f6f-47a7-b298-7daea11cad79.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2615
                                                                                                                                                              Entropy (8bit):4.195034817671197
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:15222E93E555A5243022D6F126F420B8
                                                                                                                                                              SHA1:48D83D129F4FFD07BCDB1A001C9BC55A3980337C
                                                                                                                                                              SHA-256:6C79DDDBEFAD3EFB77CB14451F944D58F81690E4183EB246E1440BD8ABCE4546
                                                                                                                                                              SHA-512:3D656DD87B7A3E7587E9B14C3232E1ADA5074569F5F2126C52EBB3522784473C630C9D1FCEA85A47D51A02FEB72265C5A1F809E4D385F89B6CB7DA2ABBA8EEC4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{.. "checksum": "6aa34186c8de766a8c605ffa8bec0703",.. "roots": {.. "bookmark_bar": {.. "children": [ ],.. "date_added": "13361901384456105",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "0bc5d13f-2cba-5d74-951f-3f233fe6c908",.. "id": "1",.. "name": "Bookmarks bar",.. "type": "folder".. },.. "other": {.. "children": [ ],.. "date_added": "13361901384456113",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "82b081ec-3dd3-529c-8475-ab6c344590dd",.. "id": "2",.. "name": "Other bookmarks",.. "type": "folder".. },.. "sponsored": {.. "children": [ {.. "children": [ ],.. "date_added": "13361901384877833",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "073f08f3-a05a-4170-b357-0a9149f1ce6f",.. "id": "6",.. "name": "Act

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\51f627f9-20b3-4c58-8b9f-b399aae8af37.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with very long lines (39113), with no line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):39197
                                                                                                                                                              Entropy (8bit):4.966019551222512
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:8EFD183DE99A98A6BF83741DE70CEA03
                                                                                                                                                              SHA1:894BE1D9724016C6694A585C96B532D1603B2F54
                                                                                                                                                              SHA-256:FD73C1C5B117E74E8F11683002C04CB28C8C643524F524FF2A293378423CB172
                                                                                                                                                              SHA-512:95693054C535604478C246D99594754615ECD6088C0C05D82B8119CE23583A75C174353FFC02E58F1836AC2036D8FB76ADAA0CDE14CF900267F2854A0622BADC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"account_tracker_service_last_update":"13361901386858197","adblock":{"install_first_run_subscriptions":false},"alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autofill":{"last_version_deduped":124},"browser":{"has_seen_welcome_page":false},"countryid_at_install":17224,"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13361901387006868"},"engagement":{"changed_by_user":{"extensions":{"pbnlklembegknchclakjohhpdccfllbe":{"state":false},"pnhojlpkdnfhikpofiijpojgpejkdgpj":{"state":false},"safer":{"security":{"tiles_last_state":{"adb":{"mode":false}}}}},"translate":{"enabled":false}},"extensions":{"prefs":{"pbnlklembegknchclakjohhpdccfllbe":{"state":{"force":false,"force_timestamp":1715859060,"type":"number","value":0}},"pnhojlpkdnfhikpofiijpojgpejkdgpj":{"state":{"force":false,"force_timestamp":1717004178,"type":"number","value":0}}},"prefs_ids":["pbnlklembegknchclakjohhpdccfllbe"]}},"enterprise_profile_guid":"06d2f367

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\65f1442d-733e-45a5-9a3f-09dc9af70f52.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:very short file (no magic)
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1
                                                                                                                                                              Entropy (8bit):0.0
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                                                                                              SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                                                                                              SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                                                                                              SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\814602de-d550-4895-aed3-1ccedb1800e9.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2615
                                                                                                                                                              Entropy (8bit):4.195034817671197
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:15222E93E555A5243022D6F126F420B8
                                                                                                                                                              SHA1:48D83D129F4FFD07BCDB1A001C9BC55A3980337C
                                                                                                                                                              SHA-256:6C79DDDBEFAD3EFB77CB14451F944D58F81690E4183EB246E1440BD8ABCE4546
                                                                                                                                                              SHA-512:3D656DD87B7A3E7587E9B14C3232E1ADA5074569F5F2126C52EBB3522784473C630C9D1FCEA85A47D51A02FEB72265C5A1F809E4D385F89B6CB7DA2ABBA8EEC4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{.. "checksum": "6aa34186c8de766a8c605ffa8bec0703",.. "roots": {.. "bookmark_bar": {.. "children": [ ],.. "date_added": "13361901384456105",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "0bc5d13f-2cba-5d74-951f-3f233fe6c908",.. "id": "1",.. "name": "Bookmarks bar",.. "type": "folder".. },.. "other": {.. "children": [ ],.. "date_added": "13361901384456113",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "82b081ec-3dd3-529c-8475-ab6c344590dd",.. "id": "2",.. "name": "Other bookmarks",.. "type": "folder".. },.. "sponsored": {.. "children": [ {.. "children": [ ],.. "date_added": "13361901384877833",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "073f08f3-a05a-4170-b357-0a9149f1ce6f",.. "id": "6",.. "name": "Act

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Bookmarks (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2615
                                                                                                                                                              Entropy (8bit):4.195034817671197
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:15222E93E555A5243022D6F126F420B8
                                                                                                                                                              SHA1:48D83D129F4FFD07BCDB1A001C9BC55A3980337C
                                                                                                                                                              SHA-256:6C79DDDBEFAD3EFB77CB14451F944D58F81690E4183EB246E1440BD8ABCE4546
                                                                                                                                                              SHA-512:3D656DD87B7A3E7587E9B14C3232E1ADA5074569F5F2126C52EBB3522784473C630C9D1FCEA85A47D51A02FEB72265C5A1F809E4D385F89B6CB7DA2ABBA8EEC4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{.. "checksum": "6aa34186c8de766a8c605ffa8bec0703",.. "roots": {.. "bookmark_bar": {.. "children": [ ],.. "date_added": "13361901384456105",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "0bc5d13f-2cba-5d74-951f-3f233fe6c908",.. "id": "1",.. "name": "Bookmarks bar",.. "type": "folder".. },.. "other": {.. "children": [ ],.. "date_added": "13361901384456113",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "82b081ec-3dd3-529c-8475-ab6c344590dd",.. "id": "2",.. "name": "Other bookmarks",.. "type": "folder".. },.. "sponsored": {.. "children": [ {.. "children": [ ],.. "date_added": "13361901384877833",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "073f08f3-a05a-4170-b357-0a9149f1ce6f",.. "id": "6",.. "name": "Act

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Bookmarks~RF5e73fe.TMP (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2615
                                                                                                                                                              Entropy (8bit):4.195034817671197
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:15222E93E555A5243022D6F126F420B8
                                                                                                                                                              SHA1:48D83D129F4FFD07BCDB1A001C9BC55A3980337C
                                                                                                                                                              SHA-256:6C79DDDBEFAD3EFB77CB14451F944D58F81690E4183EB246E1440BD8ABCE4546
                                                                                                                                                              SHA-512:3D656DD87B7A3E7587E9B14C3232E1ADA5074569F5F2126C52EBB3522784473C630C9D1FCEA85A47D51A02FEB72265C5A1F809E4D385F89B6CB7DA2ABBA8EEC4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{.. "checksum": "6aa34186c8de766a8c605ffa8bec0703",.. "roots": {.. "bookmark_bar": {.. "children": [ ],.. "date_added": "13361901384456105",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "0bc5d13f-2cba-5d74-951f-3f233fe6c908",.. "id": "1",.. "name": "Bookmarks bar",.. "type": "folder".. },.. "other": {.. "children": [ ],.. "date_added": "13361901384456113",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "82b081ec-3dd3-529c-8475-ab6c344590dd",.. "id": "2",.. "name": "Other bookmarks",.. "type": "folder".. },.. "sponsored": {.. "children": [ {.. "children": [ ],.. "date_added": "13361901384877833",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "073f08f3-a05a-4170-b357-0a9149f1ce6f",.. "id": "6",.. "name": "Act

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Code Cache\js\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):24
                                                                                                                                                              Entropy (8bit):2.1431558784658327
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                              SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                              SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                              SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:0\r..m..................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Code Cache\js\index-dir\temp-index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):48
                                                                                                                                                              Entropy (8bit):2.955557653394731
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:04361D1CA272AF5189F28E6A3941F822
                                                                                                                                                              SHA1:26B3D3F1B4CBC645F4F4D462E70994D5FCF123AF
                                                                                                                                                              SHA-256:3BAE9955C8E0F2FD94D3AC34CDD7B51A30BCCD9D04BCB579BD4CDDAA2EADCD4E
                                                                                                                                                              SHA-512:75B1523E9B355287356D1FED482F5B2D0691073703DC64B76E32E2041658A2C4284DADEE0B81CE53174D9F2017067737CAC996FADB65986B131B9C3FA22BE190
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:(...Y[.$oy retne.............................x/.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Code Cache\js\index-dir\the-real-index (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):48
                                                                                                                                                              Entropy (8bit):2.955557653394731
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:04361D1CA272AF5189F28E6A3941F822
                                                                                                                                                              SHA1:26B3D3F1B4CBC645F4F4D462E70994D5FCF123AF
                                                                                                                                                              SHA-256:3BAE9955C8E0F2FD94D3AC34CDD7B51A30BCCD9D04BCB579BD4CDDAA2EADCD4E
                                                                                                                                                              SHA-512:75B1523E9B355287356D1FED482F5B2D0691073703DC64B76E32E2041658A2C4284DADEE0B81CE53174D9F2017067737CAC996FADB65986B131B9C3FA22BE190
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:(...Y[.$oy retne.............................x/.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Code Cache\wasm\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):24
                                                                                                                                                              Entropy (8bit):2.1431558784658327
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                              SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                              SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                              SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:0\r..m..................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Code Cache\wasm\index-dir\temp-index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):48
                                                                                                                                                              Entropy (8bit):2.9972243200613975
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:C425FD8526BCBD9B7709B34D2E775FE6
                                                                                                                                                              SHA1:7C7D5549E4864BA5D254639530A79FE886FED001
                                                                                                                                                              SHA-256:86BD97C7BF9054004675435AC7088E54CB9616F7E43CCBB971ADCB6C6F340269
                                                                                                                                                              SHA-512:F5134456CE4B68CD61BCFD05B006705DCD24F096D95B5E8054ECE18774B598F30A21A6CFC56FEB1394FF1F301CE7390A9DD08C83EC0D3C106C2B0091BB03880F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:(...W<L.oy retne........................Xv...x/.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Code Cache\wasm\index-dir\the-real-index (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):48
                                                                                                                                                              Entropy (8bit):2.9972243200613975
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:C425FD8526BCBD9B7709B34D2E775FE6
                                                                                                                                                              SHA1:7C7D5549E4864BA5D254639530A79FE886FED001
                                                                                                                                                              SHA-256:86BD97C7BF9054004675435AC7088E54CB9616F7E43CCBB971ADCB6C6F340269
                                                                                                                                                              SHA-512:F5134456CE4B68CD61BCFD05B006705DCD24F096D95B5E8054ECE18774B598F30A21A6CFC56FEB1394FF1F301CE7390A9DD08C83EC0D3C106C2B0091BB03880F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:(...W<L.oy retne........................Xv...x/.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\DawnGraphiteCache\data_0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.01057775872642915
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\DawnGraphiteCache\data_1

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):270336
                                                                                                                                                              Entropy (8bit):8.280239615765425E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                              SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                              SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                              SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\DawnGraphiteCache\data_2

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.011852361981932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\DawnGraphiteCache\data_3

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.012340643231932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\DawnGraphiteCache\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):262512
                                                                                                                                                              Entropy (8bit):9.553120663130604E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:BBC14CD56943DF9558DA29749F8CAD8E
                                                                                                                                                              SHA1:2AB188C64DDE67C2562FFEEAC16480740F766D5B
                                                                                                                                                              SHA-256:59A36BB48327917F55C26215BCBA0D46B77D5EB85EC29CE8CBF152A2685A66DD
                                                                                                                                                              SHA-512:D3B77BB85AA217ECF13696D805E3C32B39869BDC46F0AEAFA2981812DDAC0A768A03CC35D89B54DCBD2D9BA5E88EEACC91A224230BDF6FB8AD62E835616E0043
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................BV...x/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\DawnWebGPUCache\data_0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.01057775872642915
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\DawnWebGPUCache\data_1

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):270336
                                                                                                                                                              Entropy (8bit):8.280239615765425E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                              SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                              SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                              SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\DawnWebGPUCache\data_2

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.011852361981932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\DawnWebGPUCache\data_3

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.012340643231932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\DawnWebGPUCache\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):262512
                                                                                                                                                              Entropy (8bit):9.553120663130604E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:E7797EFC238908305EE11F0963F6A850
                                                                                                                                                              SHA1:4F64ED488EB97D139D81E0854B08364F483558A2
                                                                                                                                                              SHA-256:49EFE0271548D7593779ABE42F5DAA4547C27DB679BE3C9DCC472221ADAB0A09
                                                                                                                                                              SHA-512:05880098B1B6A934C5B8846F0999355210EC2E30B1766EF3FDF758ABB0FFF300EE58A7AE0D35657AC53BAA9A86F4577BE61C93AA321BF785547E95449CDD0E85
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.........................................m...x/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Extension Rules\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Extension Rules\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):76
                                                                                                                                                              Entropy (8bit):1.8784775129881184
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CC4A8CFF19ABF3DD35D63CFF1503AA5F
                                                                                                                                                              SHA1:52AF41B0D9C78AFCC8E308DB846C2B52A636BE38
                                                                                                                                                              SHA-256:CC5DACF370F324B77B50DDDF5D995FD3C7B7A587CB2F55AC9F24C929D0CD531A
                                                                                                                                                              SHA-512:0E9559CDA992AA2174A7465745884F73B96755008384D21A0685941ACF099C89C8203B13551DE72A87B8E23CDAAE3FA513BC700B38E1BF3B9026955D97920320
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.f.5................f.5................f.5................f.5...............

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Extension Rules\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Extension Rules\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):291
                                                                                                                                                              Entropy (8bit):5.236912279086004
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:856A150DEB8502B5F048DE4C4B88413E
                                                                                                                                                              SHA1:E15C4C7A04A65B08C785B195EC8DE14FFC81C2C0
                                                                                                                                                              SHA-256:5C1050A7F8BBAE4A64E6F6FEA0F7A15B2210FA5A3A15763AD9B4D22EBC0E8EB4
                                                                                                                                                              SHA-512:446F345E4226A2672C910567837CC2B7AB031A0A3E96C21C607096D94C089262FF7C71025E3C184F37229B0306329E134F5E295148CC259DB2CE0617CB0A84A7
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:2024/06/03-11:16:24.984 1784 Creating DB C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Extension Rules since it was missing..2024/06/03-11:16:26.826 1784 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Extension Rules/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Extension Rules\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Extension Scripts\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Extension Scripts\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):76
                                                                                                                                                              Entropy (8bit):1.8784775129881184
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CC4A8CFF19ABF3DD35D63CFF1503AA5F
                                                                                                                                                              SHA1:52AF41B0D9C78AFCC8E308DB846C2B52A636BE38
                                                                                                                                                              SHA-256:CC5DACF370F324B77B50DDDF5D995FD3C7B7A587CB2F55AC9F24C929D0CD531A
                                                                                                                                                              SHA-512:0E9559CDA992AA2174A7465745884F73B96755008384D21A0685941ACF099C89C8203B13551DE72A87B8E23CDAAE3FA513BC700B38E1BF3B9026955D97920320
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.f.5................f.5................f.5................f.5...............

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Extension Scripts\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Extension Scripts\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):295
                                                                                                                                                              Entropy (8bit):5.2175387736262255
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:72EAFBE047718BCDF960B5CADCC5AFD0
                                                                                                                                                              SHA1:D5687B95FA306262714D20DA479CE8DA1CEB9047
                                                                                                                                                              SHA-256:04769ECE4D6BCF83DACD02E8ACD15339E38393088D4B815BF5E2B1BAEC7D71B4
                                                                                                                                                              SHA-512:00D9FBD82FF1916C34497235995D63D12955B7FBE5F108954D591EA5DC7367F48C91A171CB5456898CD8C375C916F6B13BB60754D56B84BD21D03C190118C604
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:2024/06/03-11:16:27.087 1784 Creating DB C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Extension Scripts since it was missing..2024/06/03-11:16:27.466 1784 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Extension Scripts/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Extension Scripts\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Extension State\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Extension State\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):228
                                                                                                                                                              Entropy (8bit):1.8784775129881184
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:AF1D95E1F9EB485393273B25446E1AE5
                                                                                                                                                              SHA1:1D762C96B1C38BA6A849A5B76D12FAC636B8D780
                                                                                                                                                              SHA-256:48D535BB330519C00D150578734C6CECB056C4B5CDD2A45C70590BC896D27D9F
                                                                                                                                                              SHA-512:826D207EDD55401E1C13249350814ADBB3AB00A135C46B8DA8BB7267751C70580F183982CCCBC1E47BF3E3F433F20BA1D2F2AFD601FCB67B635C0E7429558165
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Extension State\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Extension State\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):291
                                                                                                                                                              Entropy (8bit):5.189688627916028
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:7D680B1C1B703E51E1EA67AE029D03C9
                                                                                                                                                              SHA1:4D8969D0812FA4AC4937AD1B677E6CE56FF15F35
                                                                                                                                                              SHA-256:80B293436F291F4003F452346C53EB3985E7976E9FD4198A9959973A6347909D
                                                                                                                                                              SHA-512:D965EE869DAC463CB153B965FCDF1DE54B2337C4673FAB90335CA919D0F69EA2D388462CAFD0B5903E1599912F8DFB7F4369254BC2F1CE9F204901BEA3825180
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:2024/06/03-11:16:28.178 1784 Creating DB C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Extension State since it was missing..2024/06/03-11:16:28.468 1784 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Extension State/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Extension State\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Favicons

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045001, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20480
                                                                                                                                                              Entropy (8bit):0.6972286527400751
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F56E431B1D09B7EE9076AC27C118CD1E
                                                                                                                                                              SHA1:FD00BDD050F91F04E12091C5786438F7F9B0B28F
                                                                                                                                                              SHA-256:0DB6438854D1086C869C9BDA01877547517CD155CC8336DC1838ABE3458B4BF6
                                                                                                                                                              SHA-512:54F7B298F2F7447FA071F58BDB1BB80ACBDB1C0DE4EA46760D391427649B8F255F040C650AB758700289AD5B35096EF8192EFF77C4E3C47D72713148A4AD3714
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................v..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\GCM Store\Encryption\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\GCM Store\Encryption\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\GCM Store\Encryption\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):299
                                                                                                                                                              Entropy (8bit):5.313861917712636
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:68CC7D04F7C7FF9A6B43EC2A377BBC00
                                                                                                                                                              SHA1:B84249D094D23C26F23113048D1723DCA4E8FB23
                                                                                                                                                              SHA-256:835E87BA719A9BBC05CA9656BF39928F6746612F04C8C6AE272C0CBE253117A8
                                                                                                                                                              SHA-512:090EEFDC411F5D85A80E4AE499A019F140CDD55443F94B60E0D1A2D6116956B83031165239A1D84934319E9EA7FB977D52CD35BD6F67152D99E46FDB8003CDB5
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:2024/06/03-11:16:35.882 b2c Creating DB C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\GCM Store\Encryption since it was missing..2024/06/03-11:16:35.971 b2c Reusing MANIFEST C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\GCM Store\Encryption/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\GCM Store\Encryption\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\GPUCache\data_0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.01057775872642915
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\GPUCache\data_1

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):270336
                                                                                                                                                              Entropy (8bit):0.0012471779557650352
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                                                                                                              SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                                                                                                              SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                                                                                                              SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\GPUCache\data_2

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.011852361981932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\GPUCache\data_3

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.012340643231932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\GPUCache\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):262512
                                                                                                                                                              Entropy (8bit):9.448177365217996E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:BAAE6796106B43B8CF9BFEA46A3C03AD
                                                                                                                                                              SHA1:14B4A091A29371EA4720EBD2E07E33A43D00096C
                                                                                                                                                              SHA-256:3F54C3FCED4F2E4F01882BF9686C05D7C7A225DE5EC97DF53D1A4B8615ED2C1A
                                                                                                                                                              SHA-512:1F509D5038BDD38E4872A436D18E45229AC70E8FD77D69CC59B5885DC7C09F34DFB2762966E6A6E1EE07AD89AF2276C82B62AC95A2F7FD42257FD5724C689812
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................q....x/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\History

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045001, file counter 1, database pages 42, cookie 0x22, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):172032
                                                                                                                                                              Entropy (8bit):0.5518122597715659
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:BE25437D70CFD0631A1E7DEE51C27B4A
                                                                                                                                                              SHA1:2DEC5BEF0F50305BE9C8953CEE29BEB0B0226FB2
                                                                                                                                                              SHA-256:678CCE6027AC739CD65465BDDF3711C569E598FECAD7CEA4D5127FE3B26D0296
                                                                                                                                                              SHA-512:15F9EC95BDA5BB02F478FEF5A8C2285982768ACDD4E88D745E145AF2B5A240F34516B2BCE626D195E146CBA0384413BDD5551B69845C551D77F7ED8032E14444
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:SQLite format 3......@ .......*..........."......................................................v............*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Local Storage\leveldb\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Local Storage\leveldb\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Local Storage\leveldb\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):301
                                                                                                                                                              Entropy (8bit):5.273817988856038
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CBDAAE98EB0876CECF0381A1CB649C52
                                                                                                                                                              SHA1:DFEC2C2A2BF7CFEB5038C8DAB507922DE89E0398
                                                                                                                                                              SHA-256:FEE9B40E7719928A285E42BF98AA92CA520CA615AE97DDE2133C2590948DE488
                                                                                                                                                              SHA-512:576A72637016A98F2380B7C2EBF0CB5B5C7B816EB6318E37F3420BE18A0BA441FE336CBF6A06E5C298AE4DB6C51BD7F8337348EE5B5B0B28111637C4A5044D66
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:2024/06/03-11:16:33.405 f64 Creating DB C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Local Storage\leveldb since it was missing..2024/06/03-11:16:33.597 f64 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Local Storage\leveldb/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Local Storage\leveldb\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Login Data

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045001, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):40960
                                                                                                                                                              Entropy (8bit):0.8621516222976348
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:6EDCEE50C30F90C2CF65EB05BE6EFBF8
                                                                                                                                                              SHA1:F661C53AECFC5F67D2DA7FEF4147ADCD3B0B5AD4
                                                                                                                                                              SHA-256:53F55645EDA206ACE58251A76ECEF177883FA59D5FA03A5C7B89810B8B2DC06B
                                                                                                                                                              SHA-512:61B5864A5C199950CA8B9F8E3CF9C244D943B9321CA5C6D9016E79E1030FD09E57E3C030A5BFF5207E8ED56D8CD67FE59975666B41765C82AA0B282CE3C8C87B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................v.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Login Data For Account

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045001, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):40960
                                                                                                                                                              Entropy (8bit):0.8621516222976348
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:6EDCEE50C30F90C2CF65EB05BE6EFBF8
                                                                                                                                                              SHA1:F661C53AECFC5F67D2DA7FEF4147ADCD3B0B5AD4
                                                                                                                                                              SHA-256:53F55645EDA206ACE58251A76ECEF177883FA59D5FA03A5C7B89810B8B2DC06B
                                                                                                                                                              SHA-512:61B5864A5C199950CA8B9F8E3CF9C244D943B9321CA5C6D9016E79E1030FD09E57E3C030A5BFF5207E8ED56D8CD67FE59975666B41765C82AA0B282CE3C8C87B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................v.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Preferences (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with very long lines (39113), with no line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):39197
                                                                                                                                                              Entropy (8bit):4.966019551222512
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:8EFD183DE99A98A6BF83741DE70CEA03
                                                                                                                                                              SHA1:894BE1D9724016C6694A585C96B532D1603B2F54
                                                                                                                                                              SHA-256:FD73C1C5B117E74E8F11683002C04CB28C8C643524F524FF2A293378423CB172
                                                                                                                                                              SHA-512:95693054C535604478C246D99594754615ECD6088C0C05D82B8119CE23583A75C174353FFC02E58F1836AC2036D8FB76ADAA0CDE14CF900267F2854A0622BADC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"account_tracker_service_last_update":"13361901386858197","adblock":{"install_first_run_subscriptions":false},"alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autofill":{"last_version_deduped":124},"browser":{"has_seen_welcome_page":false},"countryid_at_install":17224,"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13361901387006868"},"engagement":{"changed_by_user":{"extensions":{"pbnlklembegknchclakjohhpdccfllbe":{"state":false},"pnhojlpkdnfhikpofiijpojgpejkdgpj":{"state":false},"safer":{"security":{"tiles_last_state":{"adb":{"mode":false}}}}},"translate":{"enabled":false}},"extensions":{"prefs":{"pbnlklembegknchclakjohhpdccfllbe":{"state":{"force":false,"force_timestamp":1715859060,"type":"number","value":0}},"pnhojlpkdnfhikpofiijpojgpejkdgpj":{"state":{"force":false,"force_timestamp":1717004178,"type":"number","value":0}}},"prefs_ids":["pbnlklembegknchclakjohhpdccfllbe"]}},"enterprise_profile_guid":"06d2f367

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\README

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text, with no line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):190
                                                                                                                                                              Entropy (8bit):4.3298065206758105
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:447E9C7C8E1880A239F998EEB488AACF
                                                                                                                                                              SHA1:FE011F4F83724C9AC4BF0A507C3A220D88A17324
                                                                                                                                                              SHA-256:DBF507E5DCA91C5DAC506518EDEDD79C093E61930F8B137B85452C905B2CDD89
                                                                                                                                                              SHA-512:87A0F3F6D73D00BB8D6C9B55E9C0B64497B9327D670290895B94880145BDEDFFCACBF9E4EBFE560AAF43BC82DB40CA3648B2C7F4D516C5C0CB1BE7E696CC51CC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:AVG Secure Browser settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through AVG Secure Browser defined APIs.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Secure Preferences (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10847
                                                                                                                                                              Entropy (8bit):5.575655068524558
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:AF339C903BCA131E4E9E2B0B4513A5DB
                                                                                                                                                              SHA1:B15FB707C8F68A0FFF502070D2FF9944A5498988
                                                                                                                                                              SHA-256:E9E601B3CD2B0BE19E207C03190870F318D67F5CB75FE7F0ED2276644E762A8F
                                                                                                                                                              SHA-512:84D6634381C92EE1010C95EE1101302A45384DDB15184ABEF70C070A75509C72AA8A50B113213160A10964D8A1EF2B7CADEA1F1372A5A9B52FF3C9C33FB91C7D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13361901384840401","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13361901384840401","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore","https://addons.avast.com/","https://addons.avg.com/","https://addons.ccleaner.com/","https://addons.avast.securebrowser.com","https://addons.avg.securebrowser.com","https://addons.ccleaner.securebrowser.com","https://addons.avira.securebrowser.com","https://addons.norton.securebrowser.com","https://test-browser-addons.svc.avast.com"]},"description":"Discover grea

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Session Storage\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Session Storage\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Session Storage\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):289
                                                                                                                                                              Entropy (8bit):5.232166526681714
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:23D7F8FB34FE4FD97E21FDE90C0E0F42
                                                                                                                                                              SHA1:D44400808B1191E3B004032680009E08EB1B97E7
                                                                                                                                                              SHA-256:AAC1A885A3CC739B7F5F6ACD3DCFD437ED0A3AF0808593152CDDC2614837F602
                                                                                                                                                              SHA-512:C6953307EA5C5C5557E81CD9D86C0FD503E42D9A5FF53836ABAB372E6CD4BE7355D5EBF401BD5150EC0743DB04E4B17D7B7D1E6C5F230AEA57541E316D974A34
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:2024/06/03-11:16:33.485 f2c Creating DB C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Session Storage since it was missing..2024/06/03-11:16:33.679 f2c Reusing MANIFEST C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Session Storage/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Session Storage\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Site Characteristics Database\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Site Characteristics Database\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):40
                                                                                                                                                              Entropy (8bit):3.473726825238924
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:148079685E25097536785F4536AF014B
                                                                                                                                                              SHA1:C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
                                                                                                                                                              SHA-256:F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
                                                                                                                                                              SHA-512:C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.On.!................database_metadata.1

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Site Characteristics Database\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Site Characteristics Database\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):317
                                                                                                                                                              Entropy (8bit):5.216899168316628
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:2DC588906F6200D93747DEF914CE1EB9
                                                                                                                                                              SHA1:2AC71D3FC77E395C4FA892DE2A3AE98976672D5E
                                                                                                                                                              SHA-256:B1698D8E96DDC7381B7ABA8266D4DC27AB61F0E2BC69123EBB4C9697B8DB295B
                                                                                                                                                              SHA-512:7F2168CE66E371AE1D745C164EDF79B861E754B4CD616C6946A9CDA526BFB38C6E7BBDA0F52540B40D878F80C7FE063D0F63C4F8B387F31427DC6B6BAB8C3E1D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:2024/06/03-11:16:24.523 d98 Creating DB C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Site Characteristics Database since it was missing..2024/06/03-11:16:25.572 d98 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Site Characteristics Database/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Site Characteristics Database\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Sync Data\LevelDB\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Sync Data\LevelDB\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46
                                                                                                                                                              Entropy (8bit):4.019797536844534
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:90881C9C26F29FCA29815A08BA858544
                                                                                                                                                              SHA1:06FEE974987B91D82C2839A4BB12991FA99E1BDD
                                                                                                                                                              SHA-256:A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
                                                                                                                                                              SHA-512:15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:...n'................_mts_schema_descriptor...

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Sync Data\LevelDB\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Sync Data\LevelDB\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):295
                                                                                                                                                              Entropy (8bit):5.238715094312312
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:28CD0DACA05D9D4B57DD1206F07F5ACB
                                                                                                                                                              SHA1:710F25BE5D8523C13E66061AC7FBC0CA480BF8EA
                                                                                                                                                              SHA-256:960922D4757147958A2F30BBF0496714E7B38A94ABADAF88CF01B2EC999EB7EC
                                                                                                                                                              SHA-512:860022932400D09AA23E2EB1A715B09C1B432EA85B1F448EC741D111DE475112F449727C300F1639154B78ED4226C8D9DFEAC4E7EBD331165F80553428815783
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:2024/06/03-11:16:24.522 1ca0 Creating DB C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Sync Data\LevelDB since it was missing..2024/06/03-11:16:25.164 1ca0 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Sync Data\LevelDB/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Sync Data\LevelDB\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Top Sites

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045001, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20480
                                                                                                                                                              Entropy (8bit):0.36785910495443114
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CF2A8082F5B870F9D33DC6A8F7F2B2F8
                                                                                                                                                              SHA1:94BE32B91C123D7864B1E44FA351B940111B1366
                                                                                                                                                              SHA-256:B2502A114BEBC1036CAF47434DB4B3FA353B3730583892680B217F85C6F48A65
                                                                                                                                                              SHA-512:D1BC212BE94465A44DDF45DB75EC8028B2628E27F4F7F471B548A7946CCD99CEEF2A7CDDE9C240BA5CB47A72512D3A9C2C1DC6661A319E939F287690E380681C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................v..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Visited Links

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):131072
                                                                                                                                                              Entropy (8bit):0.002110589502647469
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:AD29A0FACA0029CD2116A0A0D44F0CA5
                                                                                                                                                              SHA1:60827656987EAB6F6A5F220F97F9A42E5635D417
                                                                                                                                                              SHA-256:6F20F18591989DFF68716AB87754CAA1B873731BEC5BB09F0489ADA9D306AA08
                                                                                                                                                              SHA-512:480254E9AC8AE4CD5FF4D75248B425EDB337D1A237C4F97E077A2F043320902CF690CF33F8037A3BA76E0AB0775575F557B61EFC563865D9A6782FCB0B4B9F87
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:VLnk.....?......5..!{.0C................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\Web Data

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045001, page size 2048, file counter 3, database pages 62, cookie 0x26, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):126976
                                                                                                                                                              Entropy (8bit):1.1538056859777632
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:A0752372BEFFEAC67AC3FE7177B0CA0D
                                                                                                                                                              SHA1:6AE1FE5F22CAA461E1EB4ABD52A942507E8844B9
                                                                                                                                                              SHA-256:D4D7A38EF0A5CEE580F3A583AD45E481F7134F7643AB6F4272F0F17191B8802C
                                                                                                                                                              SHA-512:78E96FC87B19A259D8231B0BAFA5270EAA33F0B09AFF38491E248A0AA723184DA59F3D9C3CA7E13B0A5583F85F4E7A470B664CB9996C80921E5FB82C0DB9C946
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:SQLite format 3......@ .......>...........&......................................................v............<........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\a3197428-345a-4ac8-9309-fd37c303d0af.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10847
                                                                                                                                                              Entropy (8bit):5.575655068524558
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:AF339C903BCA131E4E9E2B0B4513A5DB
                                                                                                                                                              SHA1:B15FB707C8F68A0FFF502070D2FF9944A5498988
                                                                                                                                                              SHA-256:E9E601B3CD2B0BE19E207C03190870F318D67F5CB75FE7F0ED2276644E762A8F
                                                                                                                                                              SHA-512:84D6634381C92EE1010C95EE1101302A45384DDB15184ABEF70C070A75509C72AA8A50B113213160A10964D8A1EF2B7CADEA1F1372A5A9B52FF3C9C33FB91C7D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13361901384840401","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13361901384840401","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore","https://addons.avast.com/","https://addons.avg.com/","https://addons.ccleaner.com/","https://addons.avast.securebrowser.com","https://addons.avg.securebrowser.com","https://addons.ccleaner.securebrowser.com","https://addons.avira.securebrowser.com","https://addons.norton.securebrowser.com","https://test-browser-addons.svc.avast.com"]},"description":"Discover grea

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\heavy_ad_intervention_opt_out.db

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045001, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16384
                                                                                                                                                              Entropy (8bit):0.3519250993311556
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:66B4DF4B40367E4E94BAD913AD0B265F
                                                                                                                                                              SHA1:7485848D15F64E6DB07FD64FEC0E8C266FB0736D
                                                                                                                                                              SHA-256:496534AE3B7E7B40808B4EE21051C47EAD03D4CF9C393A9C394EE2477935C86E
                                                                                                                                                              SHA-512:733CE3C209B626F678121E9F9F3FEBB8A1F583D49FB35CA6A6DF1F5408EB207E3F7C7C92883F6D2546451453DC49B10683519AE16F6C36582A8FF28D89EC6A05
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................v.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\shared_proto_db\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\shared_proto_db\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4934
                                                                                                                                                              Entropy (8bit):6.783554335504103
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:10152C7405BBD98493BA611E80251292
                                                                                                                                                              SHA1:1A9DCDE8A2141A83D6716D1EECD2E64022F77A53
                                                                                                                                                              SHA-256:E89A68262D8CDC0C84D7F77EB94EE3B5B827FB594AC60B4E1EC4208E833D788D
                                                                                                                                                              SHA-512:A2BA758532646940EFDF424D62EFCB7FE188738AB58F85E49C8D5547E012D99AB1CC3BE9F1B544FAEDC9B172D24B85808358F3B3C10FA638F4E9DAF7C5DCDAAF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:<L7.................37_DEFAULT_16v...h.... .(.0.R*.(....Session.TotalDuration.T<.A..GO .(.0.../.'.%....?..ChromeLowUserEngagement..Other...... .(...10..S...................37_DEFAULT_21........... .(.0.RZ.X...CCommerce.PriceDrops.ActiveTabNavigationComplete.IsProductDetailPage.w.cG$.. .(.0.8.R9.7...$Autofill_PolledCreditCardSuggestions...c..vP. .(.0...$........?..ShoppingUser..Other...... .(...10...J. ................37_DEFAULT_23........... .(.0.RH.F...1Omnibox.SuggestionUsed.ClientSummarizedResultType.q/.v.g:` .(.0.8.Ra._.DSELECT COUNT(id) FROM metrics WHERE metric_hash = '64BD7CCE5A95BF00'......................dh...8.0........?..Low......@..Medium......A..High..None...... .(...10....U.................37_DEFAULT_27........... .(.0.R=.;...."%..wait_for_device_info_in_seconds..60*.SyncDeviceInfoh.p...t.r.p....AndroidPhone..IosPhoneChrome..AndroidTablet..IosTablet..Desktop..Other..SyncedAndFirstDevice..NotSynced....= .(...10....M.................37_DEFAULT_32....6...............

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\shared_proto_db\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\shared_proto_db\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):289
                                                                                                                                                              Entropy (8bit):5.2869983424359575
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:8792C710A5FD8BE2FE76FAF6EEF74743
                                                                                                                                                              SHA1:31FBAEE7FAF6EF0EAC279EC6F7156EDB331F615D
                                                                                                                                                              SHA-256:3AB63B2B7AFC4D969F4EB1F2757302BFB1024B53A95CAEB2D7E1BCDFD68ACBE4
                                                                                                                                                              SHA-512:F7591494C39DF8C20CE4E10365AC0349F734CA9DBA1CEB96022FF2B22873392E77C1DBA04459282542B47F677A4BA636CA74C2F76F19A168BC6D19AF3DA1F425
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:2024/06/03-11:16:28.235 b80 Creating DB C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\shared_proto_db since it was missing..2024/06/03-11:16:28.297 b80 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\shared_proto_db/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\shared_proto_db\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\shared_proto_db\metadata\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\shared_proto_db\metadata\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):532
                                                                                                                                                              Entropy (8bit):3.9143722469827313
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:AA1E7406A9041D15FBA3D2A4E0A43361
                                                                                                                                                              SHA1:B1E07A49239E2541F99A5361EFB496EE40030200
                                                                                                                                                              SHA-256:199DA2DB517FDDB94E921601035BAAF67753875363041779144E86AB1E187D75
                                                                                                                                                              SHA-512:A78D06C5E2EFBAC5DA71B4B7E6DEEB8A8F854C23BB9C8C8B03D51C118A7D329C587CCFE42B9B1037991B03109D9F300BDA63F6E5401753E7FDACD1FDA6A7ADEE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.h.6.................__global... .t...................__global... ...w.................44_.....g....................49_........v.................21_......G&..................33_.......X..................48_......E...................37_.....`0M..................38_......Hf..................39_.........................44_..........................49_......~z..................21_......X.n.................33_.........................48_.......|.................37_.......&B.................38_........D.................39_.....

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\shared_proto_db\metadata\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\shared_proto_db\metadata\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):307
                                                                                                                                                              Entropy (8bit):5.218978099543745
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:C3A60FEF98F49B4E476B57D1278B5B8E
                                                                                                                                                              SHA1:C5552860BB375675F11EC46D6FC36FBBEAE10419
                                                                                                                                                              SHA-256:9A13016174AD98CF033BCF22133DBCCADDCF30F3652ACBA4E2424EC9942B291F
                                                                                                                                                              SHA-512:6BD7CE6FF0C54ECA52D9E06B9358D478F60BFF4D82BE4725B51666B96B0382B804A9403EF0F0FAA6CB2D937071E1BC4EA5F51DCDFB98FB14063F98BF17FB2292
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:2024/06/03-11:16:27.091 b80 Creating DB C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\shared_proto_db\metadata since it was missing..2024/06/03-11:16:27.760 b80 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\shared_proto_db\metadata/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Default\shared_proto_db\metadata\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\GrShaderCache\data_0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.01057775872642915
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\GrShaderCache\data_1

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):270336
                                                                                                                                                              Entropy (8bit):8.280239615765425E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                              SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                              SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                              SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\GrShaderCache\data_2

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.011852361981932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\GrShaderCache\data_3

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.012340643231932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\GrShaderCache\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):262512
                                                                                                                                                              Entropy (8bit):9.553120663130604E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:400F57CD43BD77A43384B585B8609B58
                                                                                                                                                              SHA1:49792D1D66D16F1DD6E8BBF9893118FEFA829234
                                                                                                                                                              SHA-256:A40D3C5C636B132AD055303F5404C648C7FB92876D28BF561163D39FB6DBCD59
                                                                                                                                                              SHA-512:225DB3E5645D2CB60E823D71BCC29B930093080F5D42CD07CB7E577D25D25ABE448B060E53F41CB2E195578D4B10A00042CB8E1BE663BCA1AF835473C1258903
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.........................................G+..x/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\GraphiteDawnCache\data_0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.01057775872642915
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\GraphiteDawnCache\data_1

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):270336
                                                                                                                                                              Entropy (8bit):8.280239615765425E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                              SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                              SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                              SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\GraphiteDawnCache\data_2

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.011852361981932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\GraphiteDawnCache\data_3

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.012340643231932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\GraphiteDawnCache\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):262512
                                                                                                                                                              Entropy (8bit):9.553120663130604E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F8764056481A726CB63835F0CA4B76E8
                                                                                                                                                              SHA1:691ABEA7CFFAA10276DDF2908C964DDB20C044D7
                                                                                                                                                              SHA-256:9AADFE8EFC6B4F72E66D148AB85786D424FC044E794A6FB6E21405874C70DC5B
                                                                                                                                                              SHA-512:DF5275D6C8BD8BCE4E3844155E7AAC94F66262157B8C1E845E7B183CE88EC499EF3DBDDC1723F8DF19AC4441DD951701A033858A9D70CC525A90FE4B1E325397
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.........................................:..x/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Last Browser

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):110
                                                                                                                                                              Entropy (8bit):3.208918779856049
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:E1CF4606C81E373D746835C9C45D7912
                                                                                                                                                              SHA1:A5B0754E8DCCE567E7F7ABBD24A643245B9F74AA
                                                                                                                                                              SHA-256:BE694DEE00C17CF52AF44D0DEFC0EE0B4C38E3CDD28B086507B945B59CF57ED3
                                                                                                                                                              SHA-512:11EF279CEC8D5E0926F05F87E019313EE3CC2A29C234B099455E8FBA3BBAD65B6F962C5BE958FE7241C3E3949AE036B2D5237BC842A6FDDFCC73E7AB4AC7875A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.A.V.G.\.B.r.o.w.s.e.r.\.A.p.p.l.i.c.a.t.i.o.n.\.A.V.G.B.r.o.w.s.e.r...e.x.e.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Last Version

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text, with no line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):15
                                                                                                                                                              Entropy (8bit):2.8225797618424915
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CDFC009DAC6840171C12D4DDAE663F2B
                                                                                                                                                              SHA1:5CB1524BF84F0ECACD2E8AE3E33B88A2FF8A0244
                                                                                                                                                              SHA-256:3F348798FF1C2D399DCF12D23FC931F6F2EDFC89C3DE45950860E9CAA004E596
                                                                                                                                                              SHA-512:31A340D735CB3375D16970A1323D568D526326747BF58A9B65166DCEDEC4022565DAF75AAD28D129DC998304CEC58F8BC73E728CE1434F27794B0177082202A1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:124.0.25069.209

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Local State (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):907
                                                                                                                                                              Entropy (8bit):5.685431940949326
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:258FDD328BAC516333C5B75FF21D962C
                                                                                                                                                              SHA1:3368BC2B730701C23C3EFDE6487E0ED7116A27A5
                                                                                                                                                              SHA-256:3CA67F745ADC0DCEBE2189C9893A2CE8E33B9FEC36DD3434DCEDE110DE6C0842
                                                                                                                                                              SHA-512:D1C068935AF1F386A93335660625C7AD4C5B929FF5E12F98D8C6F7F15320006FFB91EA738379A1E1A6D73D08386DCAA5EFBECD5F34B0D878F0C4B31BA494B8C2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACav1wecwIDRry5+jIjHRY/EAAAACYAAABBAFYARwAgAFMAZQBjAHUAcgBlACAAQgByAG8AdwBzAGUAcgAAABBmAAAAAQAAIAAAAP/RXqBftAXnys960kUQTnf/juZXCU0rW5z9ciUZC5jHAAAAAA6AAAAAAgAAIAAAAM1AgjmloZG8gsuIRYQP86F4NKSVbyBP3eUnfQH4r1DaMAAAAJGBTLuBcpC0II+sdlfNb2RGQe2N2xyl7tvstOYP0Ixk9b89fj5EqflFI9NE8M0VlUAAAAB/lxJ32Shv+gL/chBRy3a9/WXRBHtzPGGde31ScmDBwhKlu08vwAnc4tnRCN/lPHY1v1fEuAHT/AV6K4pdHoMZ"},"uninstall_metrics":{"installation_date2":"1717427782"},"user_experience_metrics":{"client_id2":"5e90899e-4d46-4a05-b033-6fcfa6333da5","client_id_timestamp":"1717427782","low_entropy_source3":932,"pseudo_low_entropy_source":1334,"stability":{"browser_last_live_timestamp":"13361901382363150","stats_buildtime":"1715185684","stats_version":"124.0.25069.209-64-devel","system_crash_count":0}},"variations_limited_entropy_synthetic_trial_seed_v2":"70"}

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Local State~RF5e6bb1.TMP (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):907
                                                                                                                                                              Entropy (8bit):5.685431940949326
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:258FDD328BAC516333C5B75FF21D962C
                                                                                                                                                              SHA1:3368BC2B730701C23C3EFDE6487E0ED7116A27A5
                                                                                                                                                              SHA-256:3CA67F745ADC0DCEBE2189C9893A2CE8E33B9FEC36DD3434DCEDE110DE6C0842
                                                                                                                                                              SHA-512:D1C068935AF1F386A93335660625C7AD4C5B929FF5E12F98D8C6F7F15320006FFB91EA738379A1E1A6D73D08386DCAA5EFBECD5F34B0D878F0C4B31BA494B8C2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACav1wecwIDRry5+jIjHRY/EAAAACYAAABBAFYARwAgAFMAZQBjAHUAcgBlACAAQgByAG8AdwBzAGUAcgAAABBmAAAAAQAAIAAAAP/RXqBftAXnys960kUQTnf/juZXCU0rW5z9ciUZC5jHAAAAAA6AAAAAAgAAIAAAAM1AgjmloZG8gsuIRYQP86F4NKSVbyBP3eUnfQH4r1DaMAAAAJGBTLuBcpC0II+sdlfNb2RGQe2N2xyl7tvstOYP0Ixk9b89fj5EqflFI9NE8M0VlUAAAAB/lxJ32Shv+gL/chBRy3a9/WXRBHtzPGGde31ScmDBwhKlu08vwAnc4tnRCN/lPHY1v1fEuAHT/AV6K4pdHoMZ"},"uninstall_metrics":{"installation_date2":"1717427782"},"user_experience_metrics":{"client_id2":"5e90899e-4d46-4a05-b033-6fcfa6333da5","client_id_timestamp":"1717427782","low_entropy_source3":932,"pseudo_low_entropy_source":1334,"stability":{"browser_last_live_timestamp":"13361901382363150","stats_buildtime":"1715185684","stats_version":"124.0.25069.209-64-devel","system_crash_count":0}},"variations_limited_entropy_synthetic_trial_seed_v2":"70"}

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Local State~RF5e6c4d.TMP (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):907
                                                                                                                                                              Entropy (8bit):5.685431940949326
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:258FDD328BAC516333C5B75FF21D962C
                                                                                                                                                              SHA1:3368BC2B730701C23C3EFDE6487E0ED7116A27A5
                                                                                                                                                              SHA-256:3CA67F745ADC0DCEBE2189C9893A2CE8E33B9FEC36DD3434DCEDE110DE6C0842
                                                                                                                                                              SHA-512:D1C068935AF1F386A93335660625C7AD4C5B929FF5E12F98D8C6F7F15320006FFB91EA738379A1E1A6D73D08386DCAA5EFBECD5F34B0D878F0C4B31BA494B8C2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACav1wecwIDRry5+jIjHRY/EAAAACYAAABBAFYARwAgAFMAZQBjAHUAcgBlACAAQgByAG8AdwBzAGUAcgAAABBmAAAAAQAAIAAAAP/RXqBftAXnys960kUQTnf/juZXCU0rW5z9ciUZC5jHAAAAAA6AAAAAAgAAIAAAAM1AgjmloZG8gsuIRYQP86F4NKSVbyBP3eUnfQH4r1DaMAAAAJGBTLuBcpC0II+sdlfNb2RGQe2N2xyl7tvstOYP0Ixk9b89fj5EqflFI9NE8M0VlUAAAAB/lxJ32Shv+gL/chBRy3a9/WXRBHtzPGGde31ScmDBwhKlu08vwAnc4tnRCN/lPHY1v1fEuAHT/AV6K4pdHoMZ"},"uninstall_metrics":{"installation_date2":"1717427782"},"user_experience_metrics":{"client_id2":"5e90899e-4d46-4a05-b033-6fcfa6333da5","client_id_timestamp":"1717427782","low_entropy_source3":932,"pseudo_low_entropy_source":1334,"stability":{"browser_last_live_timestamp":"13361901382363150","stats_buildtime":"1715185684","stats_version":"124.0.25069.209-64-devel","system_crash_count":0}},"variations_limited_entropy_synthetic_trial_seed_v2":"70"}

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\ShaderCache\data_0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.01057775872642915
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\ShaderCache\data_1

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):270336
                                                                                                                                                              Entropy (8bit):0.0012471779557650352
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                                                                                                              SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                                                                                                              SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                                                                                                              SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\ShaderCache\data_2

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.011852361981932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\ShaderCache\data_3

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.012340643231932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\ShaderCache\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):262512
                                                                                                                                                              Entropy (8bit):9.553120663130604E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:D46B9F777EE75F63C0F77099DB88BC11
                                                                                                                                                              SHA1:2E1FC9099834196CED6059570D7E970220CCADF2
                                                                                                                                                              SHA-256:6193C37E459434415F3F9D75AECFC40DEF9D1E8933175D48CBE2DE19DE28160A
                                                                                                                                                              SHA-512:8345E04D3910DA7E75F278E4E463C4390EC0EE5E3AF8DF708909CF70AA8F39B2E19D06508962137321DF7A012F092F20D107C116C78C9A9C17F5C6B2D9B0376E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:...........................................x/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\Variations

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):85
                                                                                                                                                              Entropy (8bit):4.3488360343066725
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:BC6142469CD7DADF107BE9AD87EA4753
                                                                                                                                                              SHA1:72A9AA05003FAB742B0E4DC4C5D9EDA6B9F7565C
                                                                                                                                                              SHA-256:B26DA4F8C7E283AA74386DA0229D66AF14A37986B8CA828E054FC932F68DD557
                                                                                                                                                              SHA-512:47D1A67A16F5DC6D50556C5296E65918F0A2FCAD0E8CEE5795B100FE8CD89EAF5E1FD67691E8A57AF3677883A5D8F104723B1901D11845B286474C8AC56F6182
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":0}

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\a7c43dc6-d7cc-4e2c-bcc3-319dd2e51d92.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):9120
                                                                                                                                                              Entropy (8bit):5.857505323097346
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F34A8ACDBD3B58A144B51266134BF810
                                                                                                                                                              SHA1:E015CABF5BCE09B2615C2E4F0FCF4C16264F9606
                                                                                                                                                              SHA-256:E3D7AA8B63B0E1C8BB1D4DF8956B9F76B837BE8B43BE7FECA92DAD0D740C8CEF
                                                                                                                                                              SHA-512:0ADB13F8AEFC29FA550E19B1711E2BC5419F40B4FBE7C3E5B5FC8D69BD86077D0DECA4C6FCE2F7D4559CD0D552DC1A7F2A9FAE1D1C9F40A6C7CD422A09C7A23F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"autolaunch":{"engagement_count":-1,"id":"422","restore_tabs":false,"show_infobar_count":-2,"show_ntp":false,"skip_infobar_count":1,"start_maximized":false,"state":3,"timestamp":1643760000},"background_mode":1,"breadcrumbs":{"enabled":false,"enabled_time":"13361901384109870"},"engagement":{"changed_by_user":{"background_mode":false,"search":{"search_provider_partner_override_id":false}},"forced_pref_timestamp":{"search":{"search_provider_partner_override_id":1713542100}}},"hardware_acceleration_mode_previous":true,"latest_experiments_overrides":["EnableTabMuting","browserProtect","BrowserPro","AvastVPN","BackgroundImages","PhalanxContentScanning","InterpolateGoogleTiles","NtpExtension","ReplaceUserAgent","first-search-omnibox","GpuSpoofProcessName","PhalanxJavaScriptScriptsScanning","RedesignedClose"],"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"optimization_guide":{"model_store_metadata":{}},"os_crypt":

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8108_647370180\segmentation_platform\ukm_db

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045001, file counter 11, database pages 12, cookie 0xb, schema 4, UTF-8, version-valid-for 11
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):49152
                                                                                                                                                              Entropy (8bit):0.37323556012560016
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:8A598D49D6529F9B8482A7D3D794767B
                                                                                                                                                              SHA1:488F157C512003BA2BDCB9619FD401624900B87C
                                                                                                                                                              SHA-256:25E335A8D294D1954DBBC5C5D14922460816FE3B89B3907C4FC1204DF721BE96
                                                                                                                                                              SHA-512:766DB6EE41794B96002BA4534B3B5917AA52159E8FAB8A5830D9906EDC0243DEC60F5F8D8E1C05077F83903FE98FB9786F27F285E2FB650E7C02068FD87DD59F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................v.......<..........x.....j.....<......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\3f58e0af-72fd-4637-9968-a8b9e9be180e.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):908
                                                                                                                                                              Entropy (8bit):5.7103246523939735
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:590D3AC0CC680D64197D542F56FEBAB1
                                                                                                                                                              SHA1:75A733405816211AA49DC8D092444E41BCBF5658
                                                                                                                                                              SHA-256:F9219667AC88BC0DD5D3F186315FC81EC1C444D7A60F72B68C5FF61F388DB772
                                                                                                                                                              SHA-512:D7F3366FEF613B7C64D0269CEAD57D153A2E8AD44D477745A0D746C76CD4AA05FC442EC30830FD6A39E36ED311440FBB5048914C857ABBA2B68EE1CFD6920E09
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACav1wecwIDRry5+jIjHRY/EAAAACYAAABBAFYARwAgAFMAZQBjAHUAcgBlACAAQgByAG8AdwBzAGUAcgAAABBmAAAAAQAAIAAAABjXnf9PuxOIqBXWhgIK0KswFBNQipkmSC0Jv/rxwQ+WAAAAAA6AAAAAAgAAIAAAAFFKVhR9Q+adB224PjN8TbcWtsHrJGxtkd29/PVZypaJMAAAAAMBi7ug1DG6UcESWl3r2AQgmJbuOSzGMaiav3bUpDXcaTAJxkf4xZL64P+8cMYXXUAAAACxoMzjJFUNsyJqsWxCOUMOdAQ4bXaSs1phu3yaYqTzJZjeaMJfSVECaKaY+0f9hs4URfMdvR64wuiiaR9m+KB1"},"uninstall_metrics":{"installation_date2":"1717427782"},"user_experience_metrics":{"client_id2":"d82d3385-2397-4aa1-82e7-21233bb91a09","client_id_timestamp":"1717427782","low_entropy_source3":6333,"pseudo_low_entropy_source":6069,"stability":{"browser_last_live_timestamp":"13361901382362591","stats_buildtime":"1715185684","stats_version":"124.0.25069.209-64-devel","system_crash_count":0}},"variations_limited_entropy_synthetic_trial_seed_v2":"23"}

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\41ba99d5-e105-4628-b143-272cca9cda94.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):6836
                                                                                                                                                              Entropy (8bit):5.824223057477125
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0AF55FFADDD5E97A1648E81D1CEEE7D6
                                                                                                                                                              SHA1:4648DE1C94D666EA39BBF6FFB2F090A9509EDA89
                                                                                                                                                              SHA-256:4EB8BD7FE33CC3F2E1911A52D411A0DBB4B559D03232860399771370E13F120B
                                                                                                                                                              SHA-512:BC8F6EBEB922B2AC908FE8A974FC04C5EA464008B03A62157E8AA3D582FE375A668D474D3383FABFC5A96AAFB4A4E22E63F47AAB2A889441285F48A558EA71AD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"autolaunch":{"engagement_count":-1,"id":"422","restore_tabs":false,"show_infobar_count":-2,"show_ntp":false,"skip_infobar_count":1,"start_maximized":false,"state":3,"timestamp":1643760000},"background_mode":1,"breadcrumbs":{"enabled":false,"enabled_time":"13361901384085672"},"engagement":{"changed_by_user":{"background_mode":false,"search":{"search_provider_partner_override_id":false}},"forced_pref_timestamp":{"search":{"search_provider_partner_override_id":1713542100}}},"hardware_acceleration_mode_previous":true,"latest_experiments_overrides":["EnableTabMuting","browserProtect","BrowserPro","AvastVPN","BackgroundImages","PhalanxContentScanning","InterpolateGoogleTiles","NtpExtension","ReplaceUserAgent","first-search-omnibox","GpuSpoofProcessName","PhalanxJavaScriptScriptsScanning","RedesignedClose"],"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"optimization_guide":{"model_store_metadata":{}},"os_crypt":

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\BrowserMetrics\BrowserMetrics-665DDE46-1FC0.pma

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4194304
                                                                                                                                                              Entropy (8bit):0.2546135229141558
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:FA65EE71CDBD236CA1607B7F939D8769
                                                                                                                                                              SHA1:A852EF6CE70454A37FB217A3C1AF6724A8A5459A
                                                                                                                                                              SHA-256:11BFC46A279410D6B29383EB957A96D5CBC11BE69206CFC5BA17BD412A49354C
                                                                                                                                                              SHA-512:DE40168974DF928646C39007D8C366FDB0782F6E1AA6F45425208EE60FE5FCAE0F300892E6F2E1876765D3C95FBE302BC42AE9C62DD98EFEDFE9C9AD05F3EAB1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:...@..@...@.....C.].....@...............P..................`... ...i.y.........BrowserMetrics......i.y..Yd.........A.......d...2......._.z.....Gy.7....................Gy.7....................UMA.PersistentAllocator.EarlyHistograms.BrowserMetrics......i.y.["......................................................................................................................... ..."...$...&...(...*...-...0...3...6...9...<...@...D...H...L...P...U...Z..._...d...............i.y..Yd........A...............`...v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.3...............124.0.25069.209-64-devel".en-GB*...Windows NT..10.0.190452(..x86_64..?.......".tqvqdc20,1...x86_64J..X.*..D...J..m#:^....AP....1.............../....L..H...,...CookieDeprecationFacilitatedTestingLabelOnly....LabelOnly1_20240207..<..8...(...SyntheticOptimizationGuideRemoteFetching....Disabled.$.. .......CPSS

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\1fe77c96-62f0-4e3d-a8f5-c26aa89f79d9.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2615
                                                                                                                                                              Entropy (8bit):4.193080527206412
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0562D1CED86FCE81C2464C24FA124850
                                                                                                                                                              SHA1:94C22F728EFCF2FFF9CA95B402B734F672B2F423
                                                                                                                                                              SHA-256:42637A9ADEFDAC9E33D2611BBF878ACCD9DB643BC90C53873693607D0AA3E5D2
                                                                                                                                                              SHA-512:CC42B28FA19BBC9AF62B6651C3CF29EEA10B2C904B0131E9C433E118F0E9300D3BE1743B523533CC663D9E229AB123C8AE6A74B78C050EF93FA2AAB80E466B06
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{.. "checksum": "6aa34186c8de766a8c605ffa8bec0703",.. "roots": {.. "bookmark_bar": {.. "children": [ ],.. "date_added": "13361901384592537",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "0bc5d13f-2cba-5d74-951f-3f233fe6c908",.. "id": "1",.. "name": "Bookmarks bar",.. "type": "folder".. },.. "other": {.. "children": [ ],.. "date_added": "13361901384592543",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "82b081ec-3dd3-529c-8475-ab6c344590dd",.. "id": "2",.. "name": "Other bookmarks",.. "type": "folder".. },.. "sponsored": {.. "children": [ {.. "children": [ ],.. "date_added": "13361901385106185",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "a4ead695-52c8-4c64-84a0-88a754a2bf05",.. "id": "6",.. "name": "Act

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\736588a6-8b4c-418c-84eb-127587f96de5.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with very long lines (38994), with no line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):39078
                                                                                                                                                              Entropy (8bit):4.963919638150459
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:9ACF8B27B82C65FBF572396EF641B9D1
                                                                                                                                                              SHA1:C3255690458CB8F5675AB8FE63936ADF8061E240
                                                                                                                                                              SHA-256:1DB8F5BA2CC301E9E11780DC8BCA1E7B2F9F6EA8CDA8509BA571A3B63ABBE59A
                                                                                                                                                              SHA-512:E8FBD93CFA8E9F97FDC910AE4D5E21E0C65F1301613C2AE97B0DEEE88A7D80E50132CFE752E4BEFBFE9366CA83E073A67B4267BE8D0C25E1494489D6055114F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"account_tracker_service_last_update":"13361901387058301","adblock":{"install_first_run_subscriptions":false},"alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autofill":{"last_version_deduped":124},"browser":{"has_seen_welcome_page":false},"countryid_at_install":17224,"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13361901386883193"},"engagement":{"changed_by_user":{"extensions":{"pbnlklembegknchclakjohhpdccfllbe":{"state":false},"pnhojlpkdnfhikpofiijpojgpejkdgpj":{"state":false},"safer":{"security":{"tiles_last_state":{"adb":{"mode":false}}}}},"translate":{"enabled":false}},"extensions":{"prefs":{"pbnlklembegknchclakjohhpdccfllbe":{"state":{"force":false,"force_timestamp":1715859060,"type":"number","value":0}},"pnhojlpkdnfhikpofiijpojgpejkdgpj":{"state":{"force":false,"force_timestamp":1717004178,"type":"number","value":0}}},"prefs_ids":["pbnlklembegknchclakjohhpdccfllbe"]}},"extensions":{"alerts":{"initialize

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\7596ad42-fdee-4782-afc2-8c5b0c252b24.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:very short file (no magic)
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1
                                                                                                                                                              Entropy (8bit):0.0
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                                                                                              SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                                                                                              SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                                                                                              SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\96346f58-77a8-447c-bc28-9c993af899fa.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10847
                                                                                                                                                              Entropy (8bit):5.576047420705063
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:818F7D9B3ADB0A8BDD3DE9F2101F7305
                                                                                                                                                              SHA1:7A5F241E2B64A7CE5E34A1467B4B7D002A1B7709
                                                                                                                                                              SHA-256:C327CE2528693539865C9D8C22B839E2E44A3F933A409642CB938EEFD7AC97C2
                                                                                                                                                              SHA-512:672288D5C838A8B1BADB2BA5CB85792ACB334365B0457C8767E4D33CADDB28096007EA591AC49EE8A954780D0061C9A8CD8D8394E2BCCD8BD7CAAAF43CD0A290
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13361901385007463","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13361901385007463","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore","https://addons.avast.com/","https://addons.avg.com/","https://addons.ccleaner.com/","https://addons.avast.securebrowser.com","https://addons.avg.securebrowser.com","https://addons.ccleaner.securebrowser.com","https://addons.avira.securebrowser.com","https://addons.norton.securebrowser.com","https://test-browser-addons.svc.avast.com"]},"description":"Discover grea

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Bookmarks (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2615
                                                                                                                                                              Entropy (8bit):4.193080527206412
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0562D1CED86FCE81C2464C24FA124850
                                                                                                                                                              SHA1:94C22F728EFCF2FFF9CA95B402B734F672B2F423
                                                                                                                                                              SHA-256:42637A9ADEFDAC9E33D2611BBF878ACCD9DB643BC90C53873693607D0AA3E5D2
                                                                                                                                                              SHA-512:CC42B28FA19BBC9AF62B6651C3CF29EEA10B2C904B0131E9C433E118F0E9300D3BE1743B523533CC663D9E229AB123C8AE6A74B78C050EF93FA2AAB80E466B06
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{.. "checksum": "6aa34186c8de766a8c605ffa8bec0703",.. "roots": {.. "bookmark_bar": {.. "children": [ ],.. "date_added": "13361901384592537",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "0bc5d13f-2cba-5d74-951f-3f233fe6c908",.. "id": "1",.. "name": "Bookmarks bar",.. "type": "folder".. },.. "other": {.. "children": [ ],.. "date_added": "13361901384592543",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "82b081ec-3dd3-529c-8475-ab6c344590dd",.. "id": "2",.. "name": "Other bookmarks",.. "type": "folder".. },.. "sponsored": {.. "children": [ {.. "children": [ ],.. "date_added": "13361901385106185",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "a4ead695-52c8-4c64-84a0-88a754a2bf05",.. "id": "6",.. "name": "Act

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Bookmarks~RF5e7824.TMP (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2615
                                                                                                                                                              Entropy (8bit):4.193080527206412
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0562D1CED86FCE81C2464C24FA124850
                                                                                                                                                              SHA1:94C22F728EFCF2FFF9CA95B402B734F672B2F423
                                                                                                                                                              SHA-256:42637A9ADEFDAC9E33D2611BBF878ACCD9DB643BC90C53873693607D0AA3E5D2
                                                                                                                                                              SHA-512:CC42B28FA19BBC9AF62B6651C3CF29EEA10B2C904B0131E9C433E118F0E9300D3BE1743B523533CC663D9E229AB123C8AE6A74B78C050EF93FA2AAB80E466B06
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{.. "checksum": "6aa34186c8de766a8c605ffa8bec0703",.. "roots": {.. "bookmark_bar": {.. "children": [ ],.. "date_added": "13361901384592537",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "0bc5d13f-2cba-5d74-951f-3f233fe6c908",.. "id": "1",.. "name": "Bookmarks bar",.. "type": "folder".. },.. "other": {.. "children": [ ],.. "date_added": "13361901384592543",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "82b081ec-3dd3-529c-8475-ab6c344590dd",.. "id": "2",.. "name": "Other bookmarks",.. "type": "folder".. },.. "sponsored": {.. "children": [ {.. "children": [ ],.. "date_added": "13361901385106185",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "a4ead695-52c8-4c64-84a0-88a754a2bf05",.. "id": "6",.. "name": "Act

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Code Cache\js\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):24
                                                                                                                                                              Entropy (8bit):2.1431558784658327
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                              SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                              SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                              SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:0\r..m..................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Code Cache\js\index-dir\temp-index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):48
                                                                                                                                                              Entropy (8bit):2.9972243200613975
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5624ACF38199E7C194AE8B65A57EC880
                                                                                                                                                              SHA1:AEF19375CE84286A2989BE219B84AC43E9C35F09
                                                                                                                                                              SHA-256:F8C979D7CD08606348784916D8F885BAE0525608313003188222D7CF33D427BD
                                                                                                                                                              SHA-512:A20E2BEDDDA116BC7E43CC2D49EB4C28C5D34C5354EC844FCDA15CBA64D07C05C33762C17F5DB200362EE8985590F4DFA048F58AFD19A298FF63134C62CE4481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:(.....Z.oy retne........................Mg...x/.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Code Cache\js\index-dir\the-real-index (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):48
                                                                                                                                                              Entropy (8bit):2.9972243200613975
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5624ACF38199E7C194AE8B65A57EC880
                                                                                                                                                              SHA1:AEF19375CE84286A2989BE219B84AC43E9C35F09
                                                                                                                                                              SHA-256:F8C979D7CD08606348784916D8F885BAE0525608313003188222D7CF33D427BD
                                                                                                                                                              SHA-512:A20E2BEDDDA116BC7E43CC2D49EB4C28C5D34C5354EC844FCDA15CBA64D07C05C33762C17F5DB200362EE8985590F4DFA048F58AFD19A298FF63134C62CE4481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:(.....Z.oy retne........................Mg...x/.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Code Cache\wasm\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):24
                                                                                                                                                              Entropy (8bit):2.1431558784658327
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                              SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                              SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                              SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:0\r..m..................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Code Cache\wasm\index-dir\temp-index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):48
                                                                                                                                                              Entropy (8bit):2.9972243200613975
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:9389201D564A1586F09E6D6C2066D497
                                                                                                                                                              SHA1:BBC51C90D214F6C99A91611A13140046B2986A2D
                                                                                                                                                              SHA-256:52A9A80A51A624CF0F40C1C8A9DBFC7C236D7F1490071CB80B050805032037DD
                                                                                                                                                              SHA-512:D80E739A19C3E747938FF486FD85CB15D0899EBC993FA2DAA9F9A60B25809C0D09892B43ACA7CC5A4861A8479C3DB39E5AE3F81F41D623D9FFB73049DC5CAA53
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:(....u'.oy retne............................x/.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Code Cache\wasm\index-dir\the-real-index (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):48
                                                                                                                                                              Entropy (8bit):2.9972243200613975
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:9389201D564A1586F09E6D6C2066D497
                                                                                                                                                              SHA1:BBC51C90D214F6C99A91611A13140046B2986A2D
                                                                                                                                                              SHA-256:52A9A80A51A624CF0F40C1C8A9DBFC7C236D7F1490071CB80B050805032037DD
                                                                                                                                                              SHA-512:D80E739A19C3E747938FF486FD85CB15D0899EBC993FA2DAA9F9A60B25809C0D09892B43ACA7CC5A4861A8479C3DB39E5AE3F81F41D623D9FFB73049DC5CAA53
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:(....u'.oy retne............................x/.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\DawnGraphiteCache\data_0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.01057775872642915
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\DawnGraphiteCache\data_1

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):270336
                                                                                                                                                              Entropy (8bit):8.280239615765425E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                              SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                              SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                              SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\DawnGraphiteCache\data_2

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.011852361981932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\DawnGraphiteCache\data_3

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.012340643231932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\DawnGraphiteCache\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):262512
                                                                                                                                                              Entropy (8bit):9.553120663130604E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:A7AD1CF7708D33A8DD1402F621291A7D
                                                                                                                                                              SHA1:5D8CA692FE475D3B91EE5D8B4C9F8E0796F98BAD
                                                                                                                                                              SHA-256:3674EA425D7989551A6ABB73BFBCB104EDAD16A1F75B2BBF59FF1C98546307ED
                                                                                                                                                              SHA-512:2ABD569883602F3235172701559422B231667F85E372822B87058A5561F98AAB1B7B5FBF8864E64A74C3C0185BE964DC0344DE9F1A3C5074F2F25471A2122A69
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................5.%..x/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\DawnWebGPUCache\data_0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.01057775872642915
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\DawnWebGPUCache\data_1

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):270336
                                                                                                                                                              Entropy (8bit):8.280239615765425E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                              SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                              SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                              SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\DawnWebGPUCache\data_2

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.011852361981932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\DawnWebGPUCache\data_3

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.012340643231932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\DawnWebGPUCache\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):262512
                                                                                                                                                              Entropy (8bit):9.553120663130604E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:8BAECD83ADCAB6CE0DB6EC416E98C225
                                                                                                                                                              SHA1:DD46FB8B3344CA865933155BAAFD9AB82CC03D34
                                                                                                                                                              SHA-256:FDDC10057B20458CBD17FA3824B1C8AC6220025B47F3EC7BB27C8164B596942B
                                                                                                                                                              SHA-512:4C51CBAC586C43712FB5E9586030E76017186D3D585BB99129482E7B4AE206703B6E4C0547C645E6BB7FF7E6CA32B00EA6E61E201D93AFDD9BCBFAFD74FCCAD1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.............................................x/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Extension Rules\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Extension Rules\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):76
                                                                                                                                                              Entropy (8bit):1.8784775129881184
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CC4A8CFF19ABF3DD35D63CFF1503AA5F
                                                                                                                                                              SHA1:52AF41B0D9C78AFCC8E308DB846C2B52A636BE38
                                                                                                                                                              SHA-256:CC5DACF370F324B77B50DDDF5D995FD3C7B7A587CB2F55AC9F24C929D0CD531A
                                                                                                                                                              SHA-512:0E9559CDA992AA2174A7465745884F73B96755008384D21A0685941ACF099C89C8203B13551DE72A87B8E23CDAAE3FA513BC700B38E1BF3B9026955D97920320
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.f.5................f.5................f.5................f.5...............

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Extension Rules\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Extension Rules\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):289
                                                                                                                                                              Entropy (8bit):5.253426116547595
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:3AF7F09B551E2DB1C0361B893546B98B
                                                                                                                                                              SHA1:4F8353BB953068848194D144FD47176716F5949B
                                                                                                                                                              SHA-256:029F62B11B4958E694E480EA98782D9E6B78B538695AA2E3FAA972D7DE39FF30
                                                                                                                                                              SHA-512:BADA67B49D9A3B6F76A6DD2EA565D808D15953179900925D1C8CF44D4C3480A8DB40F340706675C07C798AAC462921DFDAF3B4D68032B90A8E5228A76579F60A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:2024/06/03-11:16:25.119 efc Creating DB C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Extension Rules since it was missing..2024/06/03-11:16:25.836 efc Reusing MANIFEST C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Extension Rules/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Extension Rules\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Extension Scripts\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Extension Scripts\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):76
                                                                                                                                                              Entropy (8bit):1.8784775129881184
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CC4A8CFF19ABF3DD35D63CFF1503AA5F
                                                                                                                                                              SHA1:52AF41B0D9C78AFCC8E308DB846C2B52A636BE38
                                                                                                                                                              SHA-256:CC5DACF370F324B77B50DDDF5D995FD3C7B7A587CB2F55AC9F24C929D0CD531A
                                                                                                                                                              SHA-512:0E9559CDA992AA2174A7465745884F73B96755008384D21A0685941ACF099C89C8203B13551DE72A87B8E23CDAAE3FA513BC700B38E1BF3B9026955D97920320
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.f.5................f.5................f.5................f.5...............

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Extension Scripts\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Extension Scripts\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):293
                                                                                                                                                              Entropy (8bit):5.2320274205096196
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:2EE8652D445ED0015DA70F7C60DDF418
                                                                                                                                                              SHA1:9139B5697B7672AAB780B1FA5EFB74ECD9B238B8
                                                                                                                                                              SHA-256:97460C3F01F0702F48C783AA2F045E93BFE9AC35A0FEA38DD78587DA8240F663
                                                                                                                                                              SHA-512:1248438D86C1816337415B59BFD2A8DC36CE792491E131B26488D2C36C39ECB25D93148021ABF1DCAFA8D329F272BCCCE025103AD1DD02B2CC2047164E740280
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:2024/06/03-11:16:27.000 efc Creating DB C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Extension Scripts since it was missing..2024/06/03-11:16:27.445 efc Reusing MANIFEST C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Extension Scripts/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Extension Scripts\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Extension State\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Extension State\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):228
                                                                                                                                                              Entropy (8bit):1.8784775129881184
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:AF1D95E1F9EB485393273B25446E1AE5
                                                                                                                                                              SHA1:1D762C96B1C38BA6A849A5B76D12FAC636B8D780
                                                                                                                                                              SHA-256:48D535BB330519C00D150578734C6CECB056C4B5CDD2A45C70590BC896D27D9F
                                                                                                                                                              SHA-512:826D207EDD55401E1C13249350814ADBB3AB00A135C46B8DA8BB7267751C70580F183982CCCBC1E47BF3E3F433F20BA1D2F2AFD601FCB67B635C0E7429558165
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Extension State\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Extension State\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):289
                                                                                                                                                              Entropy (8bit):5.2314606908759576
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:C7AB50A889396B41FD2D21DDBBB61C73
                                                                                                                                                              SHA1:0D20AB27DF43265AA38B5ABB57166CB0CEC1F41D
                                                                                                                                                              SHA-256:1D32C80DD3DD91A1F1AF88B8F4B63E23EF5D453819D6AAF74848C39BAEB0E11B
                                                                                                                                                              SHA-512:6C11BB6358B8FC57A642DECB33B2E34DD400CC4DE1218796523D75FBDBA150B4E4BAB84241F1A0A7619A012B43D87B33EAB51573868153C8FBFA20554B28EF83
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:2024/06/03-11:16:27.778 efc Creating DB C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Extension State since it was missing..2024/06/03-11:16:28.059 efc Reusing MANIFEST C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Extension State/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Extension State\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Favicons

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045001, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20480
                                                                                                                                                              Entropy (8bit):0.6972286527400751
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F56E431B1D09B7EE9076AC27C118CD1E
                                                                                                                                                              SHA1:FD00BDD050F91F04E12091C5786438F7F9B0B28F
                                                                                                                                                              SHA-256:0DB6438854D1086C869C9BDA01877547517CD155CC8336DC1838ABE3458B4BF6
                                                                                                                                                              SHA-512:54F7B298F2F7447FA071F58BDB1BB80ACBDB1C0DE4EA46760D391427649B8F255F040C650AB758700289AD5B35096EF8192EFF77C4E3C47D72713148A4AD3714
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................v..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\GPUCache\data_0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.01057775872642915
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\GPUCache\data_1

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):270336
                                                                                                                                                              Entropy (8bit):0.0012471779557650352
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                                                                                                              SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                                                                                                              SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                                                                                                              SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\GPUCache\data_2

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.011852361981932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\GPUCache\data_3

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.012340643231932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\GPUCache\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):262512
                                                                                                                                                              Entropy (8bit):9.47693366977411E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:7FB7DE21BE1ADABD6983EA9E03B70A6F
                                                                                                                                                              SHA1:29F28972353BCEC07B907F4B29284F9D5FC2B555
                                                                                                                                                              SHA-256:607A777D1C3C34DBA926F4F1840A0B054CCC436CDD3576333ED5B9BDB26395E5
                                                                                                                                                              SHA-512:CDC4F177742AB1A8DC7FE04697C5CB03CF5430CA49ED32F8D560C90BF74E34CB0A99647E8A313810C6443EFE9C10E70F5F95DDC32D24B5639E6F8C1873CE7F41
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.........................................:...x/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\History

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045001, file counter 1, database pages 42, cookie 0x22, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):172032
                                                                                                                                                              Entropy (8bit):0.5518122597715659
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:BE25437D70CFD0631A1E7DEE51C27B4A
                                                                                                                                                              SHA1:2DEC5BEF0F50305BE9C8953CEE29BEB0B0226FB2
                                                                                                                                                              SHA-256:678CCE6027AC739CD65465BDDF3711C569E598FECAD7CEA4D5127FE3B26D0296
                                                                                                                                                              SHA-512:15F9EC95BDA5BB02F478FEF5A8C2285982768ACDD4E88D745E145AF2B5A240F34516B2BCE626D195E146CBA0384413BDD5551B69845C551D77F7ED8032E14444
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:SQLite format 3......@ .......*..........."......................................................v............*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Local Storage\leveldb\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Local Storage\leveldb\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Local Storage\leveldb\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):301
                                                                                                                                                              Entropy (8bit):5.2612590823144005
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:A9406082FD06D77FCB8A85A2A22C9967
                                                                                                                                                              SHA1:D1F4D79329C96B8293016082ED54D4329957FC16
                                                                                                                                                              SHA-256:978FFFC88220161C3B367DFCFDAD369DFAB1528BFCCC8CB4BEA4A70B71F77271
                                                                                                                                                              SHA-512:69EB0AB0B7FE76EE40FBA2B965AFB33DB632D78103C05E3A21B7241D263B0E8C9A5B136BE5402E1A7C1733B0AA6AF367936E68701F0BD50E51611A6EF29E45CE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:2024/06/03-11:16:29.306 6fc Creating DB C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Local Storage\leveldb since it was missing..2024/06/03-11:16:29.376 6fc Reusing MANIFEST C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Local Storage\leveldb/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Local Storage\leveldb\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Login Data

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045001, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):40960
                                                                                                                                                              Entropy (8bit):0.8621516222976348
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:6EDCEE50C30F90C2CF65EB05BE6EFBF8
                                                                                                                                                              SHA1:F661C53AECFC5F67D2DA7FEF4147ADCD3B0B5AD4
                                                                                                                                                              SHA-256:53F55645EDA206ACE58251A76ECEF177883FA59D5FA03A5C7B89810B8B2DC06B
                                                                                                                                                              SHA-512:61B5864A5C199950CA8B9F8E3CF9C244D943B9321CA5C6D9016E79E1030FD09E57E3C030A5BFF5207E8ED56D8CD67FE59975666B41765C82AA0B282CE3C8C87B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................v.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Login Data For Account

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045001, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):40960
                                                                                                                                                              Entropy (8bit):0.8621516222976348
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:6EDCEE50C30F90C2CF65EB05BE6EFBF8
                                                                                                                                                              SHA1:F661C53AECFC5F67D2DA7FEF4147ADCD3B0B5AD4
                                                                                                                                                              SHA-256:53F55645EDA206ACE58251A76ECEF177883FA59D5FA03A5C7B89810B8B2DC06B
                                                                                                                                                              SHA-512:61B5864A5C199950CA8B9F8E3CF9C244D943B9321CA5C6D9016E79E1030FD09E57E3C030A5BFF5207E8ED56D8CD67FE59975666B41765C82AA0B282CE3C8C87B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................v.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Preferences (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with very long lines (38994), with no line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):39078
                                                                                                                                                              Entropy (8bit):4.963919638150459
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:9ACF8B27B82C65FBF572396EF641B9D1
                                                                                                                                                              SHA1:C3255690458CB8F5675AB8FE63936ADF8061E240
                                                                                                                                                              SHA-256:1DB8F5BA2CC301E9E11780DC8BCA1E7B2F9F6EA8CDA8509BA571A3B63ABBE59A
                                                                                                                                                              SHA-512:E8FBD93CFA8E9F97FDC910AE4D5E21E0C65F1301613C2AE97B0DEEE88A7D80E50132CFE752E4BEFBFE9366CA83E073A67B4267BE8D0C25E1494489D6055114F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"account_tracker_service_last_update":"13361901387058301","adblock":{"install_first_run_subscriptions":false},"alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autofill":{"last_version_deduped":124},"browser":{"has_seen_welcome_page":false},"countryid_at_install":17224,"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13361901386883193"},"engagement":{"changed_by_user":{"extensions":{"pbnlklembegknchclakjohhpdccfllbe":{"state":false},"pnhojlpkdnfhikpofiijpojgpejkdgpj":{"state":false},"safer":{"security":{"tiles_last_state":{"adb":{"mode":false}}}}},"translate":{"enabled":false}},"extensions":{"prefs":{"pbnlklembegknchclakjohhpdccfllbe":{"state":{"force":false,"force_timestamp":1715859060,"type":"number","value":0}},"pnhojlpkdnfhikpofiijpojgpejkdgpj":{"state":{"force":false,"force_timestamp":1717004178,"type":"number","value":0}}},"prefs_ids":["pbnlklembegknchclakjohhpdccfllbe"]}},"extensions":{"alerts":{"initialize

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\README

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text, with no line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):190
                                                                                                                                                              Entropy (8bit):4.3298065206758105
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:447E9C7C8E1880A239F998EEB488AACF
                                                                                                                                                              SHA1:FE011F4F83724C9AC4BF0A507C3A220D88A17324
                                                                                                                                                              SHA-256:DBF507E5DCA91C5DAC506518EDEDD79C093E61930F8B137B85452C905B2CDD89
                                                                                                                                                              SHA-512:87A0F3F6D73D00BB8D6C9B55E9C0B64497B9327D670290895B94880145BDEDFFCACBF9E4EBFE560AAF43BC82DB40CA3648B2C7F4D516C5C0CB1BE7E696CC51CC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:AVG Secure Browser settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through AVG Secure Browser defined APIs.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Secure Preferences (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10847
                                                                                                                                                              Entropy (8bit):5.576047420705063
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:818F7D9B3ADB0A8BDD3DE9F2101F7305
                                                                                                                                                              SHA1:7A5F241E2B64A7CE5E34A1467B4B7D002A1B7709
                                                                                                                                                              SHA-256:C327CE2528693539865C9D8C22B839E2E44A3F933A409642CB938EEFD7AC97C2
                                                                                                                                                              SHA-512:672288D5C838A8B1BADB2BA5CB85792ACB334365B0457C8767E4D33CADDB28096007EA591AC49EE8A954780D0061C9A8CD8D8394E2BCCD8BD7CAAAF43CD0A290
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13361901385007463","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13361901385007463","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore","https://addons.avast.com/","https://addons.avg.com/","https://addons.ccleaner.com/","https://addons.avast.securebrowser.com","https://addons.avg.securebrowser.com","https://addons.ccleaner.securebrowser.com","https://addons.avira.securebrowser.com","https://addons.norton.securebrowser.com","https://test-browser-addons.svc.avast.com"]},"description":"Discover grea

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Session Storage\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Session Storage\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Session Storage\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):289
                                                                                                                                                              Entropy (8bit):5.231818060305043
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:B167BC3D3E805E825AB85FFD9F5AF04D
                                                                                                                                                              SHA1:54C780D6A73FF74D69778C89FFB938944DFC5E89
                                                                                                                                                              SHA-256:8F06E0DADD62AED30CBB76C1AC9EF368D282B8FF57C39D2314E13831DF460478
                                                                                                                                                              SHA-512:2626A70A054A02983604D342E4DC60E1118B9BE765D918455F5C82AF646EFC7875EBDE572152D5A6BA512F188C6217E70E1EB0E59915CBBA1F126D0C5486E253
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:2024/06/03-11:16:30.575 6fc Creating DB C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Session Storage since it was missing..2024/06/03-11:16:33.375 6fc Reusing MANIFEST C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Session Storage/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Session Storage\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Site Characteristics Database\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Site Characteristics Database\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):40
                                                                                                                                                              Entropy (8bit):3.473726825238924
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:148079685E25097536785F4536AF014B
                                                                                                                                                              SHA1:C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
                                                                                                                                                              SHA-256:F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
                                                                                                                                                              SHA-512:C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.On.!................database_metadata.1

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Site Characteristics Database\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Site Characteristics Database\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):319
                                                                                                                                                              Entropy (8bit):5.152189147417472
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:06FD277BFC9123298BD0D2F2140F96D6
                                                                                                                                                              SHA1:5EC60B59CD35D7EB03859357D4200FC1A317705C
                                                                                                                                                              SHA-256:2F51AFAFD16BF73E2CE53098C2D0DE61D64890AAF0C680D0D77D0E60F378953D
                                                                                                                                                              SHA-512:45642E54574E685460E2E25A9FF281DA8569AE52C3676F2FF7A626AC616A888CD1EADD18A3F13E801B9966555D6E0B96183BC01DEBE275D15FBEC100F9D3C315
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:2024/06/03-11:16:25.643 1c3c Creating DB C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Site Characteristics Database since it was missing..2024/06/03-11:16:27.003 1c3c Reusing MANIFEST C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Site Characteristics Database/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Site Characteristics Database\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Sync Data\LevelDB\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Sync Data\LevelDB\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46
                                                                                                                                                              Entropy (8bit):4.019797536844534
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:90881C9C26F29FCA29815A08BA858544
                                                                                                                                                              SHA1:06FEE974987B91D82C2839A4BB12991FA99E1BDD
                                                                                                                                                              SHA-256:A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
                                                                                                                                                              SHA-512:15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:...n'................_mts_schema_descriptor...

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Sync Data\LevelDB\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Sync Data\LevelDB\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):293
                                                                                                                                                              Entropy (8bit):5.283854916480928
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:A58F897E1F1BACB202CDC7D5AAF90C07
                                                                                                                                                              SHA1:D8940EF44CD7043CAD294862F91B4BE3A25D9C88
                                                                                                                                                              SHA-256:7B852256B46920B1081C96FAE197D6603DE70984ED039BE0E516B0E6C3A166B9
                                                                                                                                                              SHA-512:82D6E4498D69687CE8B63790CDF41C1033ED180B730C5636761733677FBA39FA05E24D7612209570E7B3421D4115FE661146AA7388D27BA1652D462A66E52A9E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:2024/06/03-11:16:24.798 8f4 Creating DB C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Sync Data\LevelDB since it was missing..2024/06/03-11:16:25.526 8f4 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Sync Data\LevelDB/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Sync Data\LevelDB\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Top Sites

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045001, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20480
                                                                                                                                                              Entropy (8bit):0.36785910495443114
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CF2A8082F5B870F9D33DC6A8F7F2B2F8
                                                                                                                                                              SHA1:94BE32B91C123D7864B1E44FA351B940111B1366
                                                                                                                                                              SHA-256:B2502A114BEBC1036CAF47434DB4B3FA353B3730583892680B217F85C6F48A65
                                                                                                                                                              SHA-512:D1BC212BE94465A44DDF45DB75EC8028B2628E27F4F7F471B548A7946CCD99CEEF2A7CDDE9C240BA5CB47A72512D3A9C2C1DC6661A319E939F287690E380681C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................v..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Visited Links

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):131072
                                                                                                                                                              Entropy (8bit):0.002110589502647469
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:007D91385CFD963F5C670F67DE4E5AEF
                                                                                                                                                              SHA1:25E72729EC9F8259C48297F0C46CB435353C7641
                                                                                                                                                              SHA-256:0DFCD719A3C0AFC22C8202D37BF44A320E1D7662B1EDF34CBA3AD1E4B31CFB9C
                                                                                                                                                              SHA-512:8778B56857DE114602AC3BFF9E7F1A12D093C9A3A16EC34FD7CFACF79FF083D4BA6B1C04D9168471712805C3EF29B17682276D9D85CB115B29223D2E31C7DACE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:VLnk.....?............XE................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\Web Data

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045001, page size 2048, file counter 3, database pages 62, cookie 0x26, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):126976
                                                                                                                                                              Entropy (8bit):1.1541902408957314
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:D50E7C253581A80F25DA7B82B7F3F0B9
                                                                                                                                                              SHA1:00336544D7CB790C24D99CE2CAC5FAC75A5E6DF4
                                                                                                                                                              SHA-256:26840BC94E4A430D0D46E09DEFA0F5C00F35BA74686DEF830BA52FFDE639B6FA
                                                                                                                                                              SHA-512:0D706F1931027DE3DBD4CA33E4739251C2DC636EA2B6796296D62E07F2729A311772E43DD791362C45E0113485DC583F1AC1EA1791E5BB640CDE14AB437D1E8B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:SQLite format 3......@ .......>...........&......................................................v............<........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\e8548a79-aeb9-479d-8fc9-e5ddaac72368.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2615
                                                                                                                                                              Entropy (8bit):4.193080527206412
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0562D1CED86FCE81C2464C24FA124850
                                                                                                                                                              SHA1:94C22F728EFCF2FFF9CA95B402B734F672B2F423
                                                                                                                                                              SHA-256:42637A9ADEFDAC9E33D2611BBF878ACCD9DB643BC90C53873693607D0AA3E5D2
                                                                                                                                                              SHA-512:CC42B28FA19BBC9AF62B6651C3CF29EEA10B2C904B0131E9C433E118F0E9300D3BE1743B523533CC663D9E229AB123C8AE6A74B78C050EF93FA2AAB80E466B06
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{.. "checksum": "6aa34186c8de766a8c605ffa8bec0703",.. "roots": {.. "bookmark_bar": {.. "children": [ ],.. "date_added": "13361901384592537",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "0bc5d13f-2cba-5d74-951f-3f233fe6c908",.. "id": "1",.. "name": "Bookmarks bar",.. "type": "folder".. },.. "other": {.. "children": [ ],.. "date_added": "13361901384592543",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "82b081ec-3dd3-529c-8475-ab6c344590dd",.. "id": "2",.. "name": "Other bookmarks",.. "type": "folder".. },.. "sponsored": {.. "children": [ {.. "children": [ ],.. "date_added": "13361901385106185",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "a4ead695-52c8-4c64-84a0-88a754a2bf05",.. "id": "6",.. "name": "Act

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\shared_proto_db\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\shared_proto_db\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4934
                                                                                                                                                              Entropy (8bit):6.783554335504103
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:10152C7405BBD98493BA611E80251292
                                                                                                                                                              SHA1:1A9DCDE8A2141A83D6716D1EECD2E64022F77A53
                                                                                                                                                              SHA-256:E89A68262D8CDC0C84D7F77EB94EE3B5B827FB594AC60B4E1EC4208E833D788D
                                                                                                                                                              SHA-512:A2BA758532646940EFDF424D62EFCB7FE188738AB58F85E49C8D5547E012D99AB1CC3BE9F1B544FAEDC9B172D24B85808358F3B3C10FA638F4E9DAF7C5DCDAAF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:<L7.................37_DEFAULT_16v...h.... .(.0.R*.(....Session.TotalDuration.T<.A..GO .(.0.../.'.%....?..ChromeLowUserEngagement..Other...... .(...10..S...................37_DEFAULT_21........... .(.0.RZ.X...CCommerce.PriceDrops.ActiveTabNavigationComplete.IsProductDetailPage.w.cG$.. .(.0.8.R9.7...$Autofill_PolledCreditCardSuggestions...c..vP. .(.0...$........?..ShoppingUser..Other...... .(...10...J. ................37_DEFAULT_23........... .(.0.RH.F...1Omnibox.SuggestionUsed.ClientSummarizedResultType.q/.v.g:` .(.0.8.Ra._.DSELECT COUNT(id) FROM metrics WHERE metric_hash = '64BD7CCE5A95BF00'......................dh...8.0........?..Low......@..Medium......A..High..None...... .(...10....U.................37_DEFAULT_27........... .(.0.R=.;...."%..wait_for_device_info_in_seconds..60*.SyncDeviceInfoh.p...t.r.p....AndroidPhone..IosPhoneChrome..AndroidTablet..IosTablet..Desktop..Other..SyncedAndFirstDevice..NotSynced....= .(...10....M.................37_DEFAULT_32....6...............

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\shared_proto_db\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\shared_proto_db\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):291
                                                                                                                                                              Entropy (8bit):5.265679905791427
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F2B8DCD73E4B5E8EEDD39F38C6977DDF
                                                                                                                                                              SHA1:00D394D33C0B7A1A405326F8E95310DA709F2412
                                                                                                                                                              SHA-256:9F76319A738AA99731513B12FF8E6079F007D5A5585823DF9A6212E1C6740359
                                                                                                                                                              SHA-512:A085707DA92638F66037CBE57AB6F257E156D40DD444014AE8A66AF54A2C9440B9E0AC50B4E7C7A930F96DBE1326D316BDE7602D553ADD3D52C12C1F8430CF19
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:2024/06/03-11:16:28.185 17a8 Creating DB C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\shared_proto_db since it was missing..2024/06/03-11:16:28.437 17a8 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\shared_proto_db/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\shared_proto_db\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\shared_proto_db\metadata\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\shared_proto_db\metadata\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):532
                                                                                                                                                              Entropy (8bit):3.895674427590837
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:9F8145C18A57269F839E1D7B3B52EEDC
                                                                                                                                                              SHA1:DD68BF281B6774FD9A0310D5C48AC79B3DC615EB
                                                                                                                                                              SHA-256:5D95763DAC1989630C390EF8F91B3A0610AA8D6105F5AC92BCDC494261E6A924
                                                                                                                                                              SHA-512:E0D0CAA34E59E21CDA5DF391780D3A5B34CC5D5D5EA27E34AAB63611BA38DB816C932DC65BF2E2A1FD7EAC1BAD7FEA8E8DCBE13CD504C8A8629BE5C10BAF9F24
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.h.6.................__global... .t...................__global... .Z..H.................48_..........................21_......F...................44_........[.................49_.......N..................33_......E...................37_.....`0M..................38_......Hf..................39_........b.................21_.......p..................48_......S.c.................44_.......22.................49_.........................33_.......|.................37_.......&B.................38_........D.................39_.....

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\shared_proto_db\metadata\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\shared_proto_db\metadata\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):309
                                                                                                                                                              Entropy (8bit):5.248584118311467
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:308F68892140629C96E05033A5E7D7B7
                                                                                                                                                              SHA1:1EB0A1CB2AFB293D75C2019148238145E3781573
                                                                                                                                                              SHA-256:EE004C59020B8E4A8EC5D4FCF485A36C77B0A901005A2CCFD095BA446BCE0EF4
                                                                                                                                                              SHA-512:318D7B2D4A3CC969211482E404D58CB2849CBC91F478E2C5D37026A01DE334051BA02FA4BC7147CD0C389574B01E40A67DDCC5D18C46599BFD30A96C5AA90DCF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:2024/06/03-11:16:27.165 17a8 Creating DB C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\shared_proto_db\metadata since it was missing..2024/06/03-11:16:27.999 17a8 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\shared_proto_db\metadata/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Default\shared_proto_db\metadata\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\GrShaderCache\data_0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.01057775872642915
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\GrShaderCache\data_1

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):270336
                                                                                                                                                              Entropy (8bit):8.280239615765425E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                              SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                              SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                              SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\GrShaderCache\data_2

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.011852361981932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\GrShaderCache\data_3

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.012340643231932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\GrShaderCache\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):262512
                                                                                                                                                              Entropy (8bit):9.553120663130604E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:896FED10A469E7353579A6E8820709F2
                                                                                                                                                              SHA1:B159918B20F658BF6539AF975504085DA71EBDC5
                                                                                                                                                              SHA-256:45C8F8A5D442047DA33B4D3035E93B1CF5B6827B5DB0179420A0C3DA0D496D6C
                                                                                                                                                              SHA-512:E848230D1F9ADF4C1451581EA039318242D5EC11FBE15D44A65F9161FF4BD1903C8DFA9291891360B633E6F1E02162BDED7FCFF0EE88FD3C25BE0258731CC349
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................c>-..x/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\GraphiteDawnCache\data_0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.01057775872642915
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\GraphiteDawnCache\data_1

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):270336
                                                                                                                                                              Entropy (8bit):8.280239615765425E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                              SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                              SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                              SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\GraphiteDawnCache\data_2

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.011852361981932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\GraphiteDawnCache\data_3

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.012340643231932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\GraphiteDawnCache\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):262512
                                                                                                                                                              Entropy (8bit):9.553120663130604E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:EE2D90843DE2B0CAC736BB75A0AB43D6
                                                                                                                                                              SHA1:E2E53DB84CA44D1820BCCCE2C536B7831149122F
                                                                                                                                                              SHA-256:4CD9D446C422E85C81DAF466D1F8EDA1F76C48DA4D10E0C4D45952372D297B9A
                                                                                                                                                              SHA-512:883EF3A615807F0439159C061BF40F1381706CBD047897D1F3F9EFF644C4052F38C54A41571C8FB6DA142FE1544893776AA029E620D666BF09812F12BFAF71EB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................N.9..x/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Last Version

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:ASCII text, with no line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):15
                                                                                                                                                              Entropy (8bit):2.8225797618424915
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CDFC009DAC6840171C12D4DDAE663F2B
                                                                                                                                                              SHA1:5CB1524BF84F0ECACD2E8AE3E33B88A2FF8A0244
                                                                                                                                                              SHA-256:3F348798FF1C2D399DCF12D23FC931F6F2EDFC89C3DE45950860E9CAA004E596
                                                                                                                                                              SHA-512:31A340D735CB3375D16970A1323D568D526326747BF58A9B65166DCEDEC4022565DAF75AAD28D129DC998304CEC58F8BC73E728CE1434F27794B0177082202A1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:124.0.25069.209

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Local State (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):908
                                                                                                                                                              Entropy (8bit):5.7103246523939735
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:590D3AC0CC680D64197D542F56FEBAB1
                                                                                                                                                              SHA1:75A733405816211AA49DC8D092444E41BCBF5658
                                                                                                                                                              SHA-256:F9219667AC88BC0DD5D3F186315FC81EC1C444D7A60F72B68C5FF61F388DB772
                                                                                                                                                              SHA-512:D7F3366FEF613B7C64D0269CEAD57D153A2E8AD44D477745A0D746C76CD4AA05FC442EC30830FD6A39E36ED311440FBB5048914C857ABBA2B68EE1CFD6920E09
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACav1wecwIDRry5+jIjHRY/EAAAACYAAABBAFYARwAgAFMAZQBjAHUAcgBlACAAQgByAG8AdwBzAGUAcgAAABBmAAAAAQAAIAAAABjXnf9PuxOIqBXWhgIK0KswFBNQipkmSC0Jv/rxwQ+WAAAAAA6AAAAAAgAAIAAAAFFKVhR9Q+adB224PjN8TbcWtsHrJGxtkd29/PVZypaJMAAAAAMBi7ug1DG6UcESWl3r2AQgmJbuOSzGMaiav3bUpDXcaTAJxkf4xZL64P+8cMYXXUAAAACxoMzjJFUNsyJqsWxCOUMOdAQ4bXaSs1phu3yaYqTzJZjeaMJfSVECaKaY+0f9hs4URfMdvR64wuiiaR9m+KB1"},"uninstall_metrics":{"installation_date2":"1717427782"},"user_experience_metrics":{"client_id2":"d82d3385-2397-4aa1-82e7-21233bb91a09","client_id_timestamp":"1717427782","low_entropy_source3":6333,"pseudo_low_entropy_source":6069,"stability":{"browser_last_live_timestamp":"13361901382362591","stats_buildtime":"1715185684","stats_version":"124.0.25069.209-64-devel","system_crash_count":0}},"variations_limited_entropy_synthetic_trial_seed_v2":"23"}

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Local State~RF5e6095.TMP (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):908
                                                                                                                                                              Entropy (8bit):5.7103246523939735
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:590D3AC0CC680D64197D542F56FEBAB1
                                                                                                                                                              SHA1:75A733405816211AA49DC8D092444E41BCBF5658
                                                                                                                                                              SHA-256:F9219667AC88BC0DD5D3F186315FC81EC1C444D7A60F72B68C5FF61F388DB772
                                                                                                                                                              SHA-512:D7F3366FEF613B7C64D0269CEAD57D153A2E8AD44D477745A0D746C76CD4AA05FC442EC30830FD6A39E36ED311440FBB5048914C857ABBA2B68EE1CFD6920E09
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACav1wecwIDRry5+jIjHRY/EAAAACYAAABBAFYARwAgAFMAZQBjAHUAcgBlACAAQgByAG8AdwBzAGUAcgAAABBmAAAAAQAAIAAAABjXnf9PuxOIqBXWhgIK0KswFBNQipkmSC0Jv/rxwQ+WAAAAAA6AAAAAAgAAIAAAAFFKVhR9Q+adB224PjN8TbcWtsHrJGxtkd29/PVZypaJMAAAAAMBi7ug1DG6UcESWl3r2AQgmJbuOSzGMaiav3bUpDXcaTAJxkf4xZL64P+8cMYXXUAAAACxoMzjJFUNsyJqsWxCOUMOdAQ4bXaSs1phu3yaYqTzJZjeaMJfSVECaKaY+0f9hs4URfMdvR64wuiiaR9m+KB1"},"uninstall_metrics":{"installation_date2":"1717427782"},"user_experience_metrics":{"client_id2":"d82d3385-2397-4aa1-82e7-21233bb91a09","client_id_timestamp":"1717427782","low_entropy_source3":6333,"pseudo_low_entropy_source":6069,"stability":{"browser_last_live_timestamp":"13361901382362591","stats_buildtime":"1715185684","stats_version":"124.0.25069.209-64-devel","system_crash_count":0}},"variations_limited_entropy_synthetic_trial_seed_v2":"23"}

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Local State~RF5e69ec.TMP (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):908
                                                                                                                                                              Entropy (8bit):5.7103246523939735
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:590D3AC0CC680D64197D542F56FEBAB1
                                                                                                                                                              SHA1:75A733405816211AA49DC8D092444E41BCBF5658
                                                                                                                                                              SHA-256:F9219667AC88BC0DD5D3F186315FC81EC1C444D7A60F72B68C5FF61F388DB772
                                                                                                                                                              SHA-512:D7F3366FEF613B7C64D0269CEAD57D153A2E8AD44D477745A0D746C76CD4AA05FC442EC30830FD6A39E36ED311440FBB5048914C857ABBA2B68EE1CFD6920E09
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACav1wecwIDRry5+jIjHRY/EAAAACYAAABBAFYARwAgAFMAZQBjAHUAcgBlACAAQgByAG8AdwBzAGUAcgAAABBmAAAAAQAAIAAAABjXnf9PuxOIqBXWhgIK0KswFBNQipkmSC0Jv/rxwQ+WAAAAAA6AAAAAAgAAIAAAAFFKVhR9Q+adB224PjN8TbcWtsHrJGxtkd29/PVZypaJMAAAAAMBi7ug1DG6UcESWl3r2AQgmJbuOSzGMaiav3bUpDXcaTAJxkf4xZL64P+8cMYXXUAAAACxoMzjJFUNsyJqsWxCOUMOdAQ4bXaSs1phu3yaYqTzJZjeaMJfSVECaKaY+0f9hs4URfMdvR64wuiiaR9m+KB1"},"uninstall_metrics":{"installation_date2":"1717427782"},"user_experience_metrics":{"client_id2":"d82d3385-2397-4aa1-82e7-21233bb91a09","client_id_timestamp":"1717427782","low_entropy_source3":6333,"pseudo_low_entropy_source":6069,"stability":{"browser_last_live_timestamp":"13361901382362591","stats_buildtime":"1715185684","stats_version":"124.0.25069.209-64-devel","system_crash_count":0}},"variations_limited_entropy_synthetic_trial_seed_v2":"23"}

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\ShaderCache\data_0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.01057775872642915
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\ShaderCache\data_1

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):270336
                                                                                                                                                              Entropy (8bit):0.0012471779557650352
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                                                                                                              SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                                                                                                              SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                                                                                                              SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\ShaderCache\data_2

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.011852361981932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\ShaderCache\data_3

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.012340643231932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\ShaderCache\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):262512
                                                                                                                                                              Entropy (8bit):9.553120663130604E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:DC8CFF466FDF0AF2B3D80BB5CDA675DF
                                                                                                                                                              SHA1:4F1124529ABBB8955A84D76B8C8BAB611AC5E0E4
                                                                                                                                                              SHA-256:FA064F67418AD6E7E057C47D80B0B595BC19481348B76342D1BA567E1C6702EB
                                                                                                                                                              SHA-512:02408E3BCE59701F1B85A10A32B363ADD068A112251E958D908F1B6670E3C77AF4BF82D15649DECBBCC5A92345219BA6F1B5C6D7773004AF31E5996778C1DE63
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:............................................x/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\Variations

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):85
                                                                                                                                                              Entropy (8bit):4.3488360343066725
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:BC6142469CD7DADF107BE9AD87EA4753
                                                                                                                                                              SHA1:72A9AA05003FAB742B0E4DC4C5D9EDA6B9F7565C
                                                                                                                                                              SHA-256:B26DA4F8C7E283AA74386DA0229D66AF14A37986B8CA828E054FC932F68DD557
                                                                                                                                                              SHA-512:47D1A67A16F5DC6D50556C5296E65918F0A2FCAD0E8CEE5795B100FE8CD89EAF5E1FD67691E8A57AF3677883A5D8F104723B1901D11845B286474C8AC56F6182
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":0}

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\b57efcc1-84f3-4031-8c03-9538de750441.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):6836
                                                                                                                                                              Entropy (8bit):5.824223057477125
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0AF55FFADDD5E97A1648E81D1CEEE7D6
                                                                                                                                                              SHA1:4648DE1C94D666EA39BBF6FFB2F090A9509EDA89
                                                                                                                                                              SHA-256:4EB8BD7FE33CC3F2E1911A52D411A0DBB4B559D03232860399771370E13F120B
                                                                                                                                                              SHA-512:BC8F6EBEB922B2AC908FE8A974FC04C5EA464008B03A62157E8AA3D582FE375A668D474D3383FABFC5A96AAFB4A4E22E63F47AAB2A889441285F48A558EA71AD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"autolaunch":{"engagement_count":-1,"id":"422","restore_tabs":false,"show_infobar_count":-2,"show_ntp":false,"skip_infobar_count":1,"start_maximized":false,"state":3,"timestamp":1643760000},"background_mode":1,"breadcrumbs":{"enabled":false,"enabled_time":"13361901384085672"},"engagement":{"changed_by_user":{"background_mode":false,"search":{"search_provider_partner_override_id":false}},"forced_pref_timestamp":{"search":{"search_provider_partner_override_id":1713542100}}},"hardware_acceleration_mode_previous":true,"latest_experiments_overrides":["EnableTabMuting","browserProtect","BrowserPro","AvastVPN","BackgroundImages","PhalanxContentScanning","InterpolateGoogleTiles","NtpExtension","ReplaceUserAgent","first-search-omnibox","GpuSpoofProcessName","PhalanxJavaScriptScriptsScanning","RedesignedClose"],"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"optimization_guide":{"model_store_metadata":{}},"os_crypt":

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Heartbeat8128_116327840\segmentation_platform\ukm_db

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045001, file counter 11, database pages 12, cookie 0xb, schema 4, UTF-8, version-valid-for 11
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):49152
                                                                                                                                                              Entropy (8bit):0.37323556012560016
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:8A598D49D6529F9B8482A7D3D794767B
                                                                                                                                                              SHA1:488F157C512003BA2BDCB9619FD401624900B87C
                                                                                                                                                              SHA-256:25E335A8D294D1954DBBC5C5D14922460816FE3B89B3907C4FC1204DF721BE96
                                                                                                                                                              SHA-512:766DB6EE41794B96002BA4534B3B5917AA52159E8FAB8A5830D9906EDC0243DEC60F5F8D8E1C05077F83903FE98FB9786F27F285E2FB650E7C02068FD87DD59F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................v.......<..........x.....j.....<......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\ajF04F.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):6116200
                                                                                                                                                              Entropy (8bit):7.990490156580378
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:ACB51434FD82EB460B052F05950B8DCA
                                                                                                                                                              SHA1:707D192DB2CE7CEFDEFCE3037DFB85A18B8811F3
                                                                                                                                                              SHA-256:29FFA251CB267969AF445EB664DF04D1A7BADBCADE61A7F754DE42B6D4340055
                                                                                                                                                              SHA-512:013DC0ABCC9760C6298B7E48007EB1AC4BC2E453F06C1CE4AFF218F50CD1E2C4BB44AD6BC5687EDB057DF8B0E38FA0AAADA7A8D045ED08412278D3031527229D
                                                                                                                                                              Malicious:true
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........18..PV..PV..PV.*_...PV..PW.MPV.*_...PV.sf..PV..VP..PV.Rich.PV.........PE..L......].................f...*.......5............@.................................Lf]...@..........................................................*].P)...........................................................................................text...{d.......f.................. ..`.rdata...............j..............@..@.data...X............~..............@....ndata...................................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\avg-securebrowser-web-tags

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):53
                                                                                                                                                              Entropy (8bit):4.208499227903183
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:4C94408946D796A8B19C17DF5CF0562D
                                                                                                                                                              SHA1:89056150D90683F9548DADC308EB2789A67C2A47
                                                                                                                                                              SHA-256:68042CB47D900C4110FFC5F46E5F8395B35F42D33FC75E58EE34C7F5D8726DE7
                                                                                                                                                              SHA-512:96A31F0B7254F42FEC787233E2D11991709BC0B2514D163DD1F7696015E7318F9810D9811473FC13D6782D65E40F6A94FE6A7FFEF3CB962032CFF3BFE8B99A29
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"campaign_id":"9249","nouac":"1","source_tag":"100"}

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsbFF62.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\ajF04F.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):700
                                                                                                                                                              Entropy (8bit):4.727166525039482
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:359CCE9C2DF62868BF4096E887993CB7
                                                                                                                                                              SHA1:F3683EE9E7ED5CFC3570D9AAF769EEF6F4FA3A95
                                                                                                                                                              SHA-256:FCD6CEBFE6E9D8BDDF1C4B09771D7D849F2FDC105F991337E45D6AA82F33B627
                                                                                                                                                              SHA-512:A5E99FA8AA18E6A7CEB7CFB0C99DC99B606567AD1DDC3BF5AB81D18502F513A9D96D264552F81508317778216B4A4360D87E96AFF302CC7F7FE1DF92C59A6737
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"version":9,"engines":[{"id":"google@search.mozilla.orgdefault","_name":"Google","_isAppProvided":true,"_metaData":{}},{"id":"amazondotcom@search.mozilla.orgdefault","_name":"Amazon.com","_isAppProvided":true,"_metaData":{}},{"id":"wikipedia@search.mozilla.orgdefault","_name":"Wikipedia (en)","_isAppProvided":true,"_metaData":{}},{"id":"bing@search.mozilla.orgdefault","_name":"Bing","_isAppProvided":true,"_metaData":{}},{"id":"ddg@search.mozilla.orgdefault","_name":"DuckDuckGo","_isAppProvided":true,"_metaData":{}}],"metaData":{"useSavedOrder":false,"locale":"en-US","region":"default","channel":"release","experiment":"","distroID":"","appDefaultEngineId":"google@search.mozilla.orgdefault"}}

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsgE448.tmp\AccessControl.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):27064
                                                                                                                                                              Entropy (8bit):6.671782479119062
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:C36EB8336B91D277DFA8575EB00D6364
                                                                                                                                                              SHA1:9EC81B49E7675548449E010950BC50BFF7CBC960
                                                                                                                                                              SHA-256:4336E05960FEE8C775B343209911F14ACBFDDE1E8D5AA9D1F0EA680FB4407307
                                                                                                                                                              SHA-512:0ABE6E367D1C934FEC8A89617B5FBFEA5AB7F8E557ADA7A667AEDB495F637C8782A2F4723C2D68B9EDAE4F426DEB5BBC0536F643FC65ECC2CD33295078474394
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9[..X5.X5.X5. ..X5.X4..X5.?1<.X5.?15.X5.?1..X5.?17.X5.Rich.X5.........PE..L...BcL^...........!......... .......*.......0............................................@.........................p<......|@..P....`..............H@..p)...p.......<..T............................................0...............................text...I........................... ..`.rdata.......0....... ..............@..@.data...L....P.......6..............@....rsrc........`.......8..............@..@.reloc.......p.......<..............@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsgE448.tmp\JsisPlugins.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2179520
                                                                                                                                                              Entropy (8bit):6.773779547617883
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:BD94620C8A3496F0922D7A443C750047
                                                                                                                                                              SHA1:23C4CB2B4D5F5256E76E54969E7E352263ABF057
                                                                                                                                                              SHA-256:C0AF9E25C35650F43DE4E8A57BB89D43099BEEAD4CA6AF6BE846319FF84D7644
                                                                                                                                                              SHA-512:954006D27ED365FDF54327D64F05B950C2F0881E395257B87BA8E4CC608EC4771DEB490D57DC988571A2E66F730E04E8FE16F356A06070ABDA1DE9F3B0C3DA68
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........................."................................C.................................................f.........Rich...................PE..L......e...........!.........B......Ht........................................!.....[.!...@......................... ................@ .8...........H.!.x)...P .t!...{..T....................|.......{..@............... ............................text............................... ..`.rdata...'.......(..................@..@.data...h....@.......*..............@....rsrc...8....@ .....................@..@.reloc..t!...P .."..................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsgE448.tmp\Midex.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129976
                                                                                                                                                              Entropy (8bit):6.690073972113693
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:581C4A0B8DE60868B89074FE94EB27B9
                                                                                                                                                              SHA1:70B8BDFDDB08164F9D52033305D535B7DB2599F6
                                                                                                                                                              SHA-256:B13C23AF49DA0A21959E564CBCA8E6B94C181C5EEB95150B29C94FF6AFB8F9DD
                                                                                                                                                              SHA-512:94290E72871C622FC32E9661719066BAFB9B393E10ED397CAE8A6F0C8BE6ED0DF88E5414F39BC528BF9A81980BDCB621745B6C712F4878F0447595CEC59EE33D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................\P5.....\P7....\P6........................W............r.......r.......r.;.......S.....r.......Rich....................PE..L....lL^...........!.....:...........E.......P............................... ......9.....@.........................0...D...t...<...................H...p).......... ...T...........................x...@............P..L............................text....9.......:.................. ..`.rdata...p...P...r...>..............@..@.data...t...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsgE448.tmp\StdUtils.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):200632
                                                                                                                                                              Entropy (8bit):6.691052135878374
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:7602B88D488E54B717A7086605CD6D8D
                                                                                                                                                              SHA1:C01200D911E744BDFFA7F31B3C23068971494485
                                                                                                                                                              SHA-256:2640E4F09AA4C117036BFDDD12DC02834E66400392761386BD1FE172A6DDFA11
                                                                                                                                                              SHA-512:A11B68BDAECC1FE3D04246CFD62DD1BB4EF5F360125B40DADF8D475E603E14F24CF35335E01E985F0E7ADCF785FDF6C57C7856722BC8DCB4DD2A1F817B1DDE3A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........f.................................x...g,.....,.......,.................a..........,......e......e.......e...............e.......Rich....................PE..L.....l^...........!................\........0............................... ............@............................T...$.......................H...p)..........0...T...................,...........@............0...............................text...8........................... ..`.rdata.......0......................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsgE448.tmp\inetc.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):38336
                                                                                                                                                              Entropy (8bit):6.325196542922235
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5C40A7C1A2965CF7CAEFACA2FC299985
                                                                                                                                                              SHA1:2220A643392893A2B9F31DB58AE2F21B398FB26F
                                                                                                                                                              SHA-256:0935C1CBA93551B6E856ECE274CBB71CE93CCC7507C0CCD2EC08A3A32BDB6915
                                                                                                                                                              SHA-512:58C5BFF3A3D25FC4426F473D53D0F0A36CC251D71EF34103186E7BC0F4E80B659E86EDC5AE798BE2DCEA2D4573C575652FC385BE9577EB5E6C82B3473B2003D0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>...z.q,z.q,z.q,...,s.q,z.p,/.q,..t-x.q,..u-{.q,..q-{.q,...,{.q,..s-{.q,Richz.q,........................PE..L...B.b^...........!.....6...|.......2.......P......................................0.....@..........................W..l...xY..d...................Hl..x)......p...PW..T............................................P..p............................text....4.......6.................. ..`.rdata.......P.......:..............@..@.data....V...p.......L..............@....rsrc................Z..............@..@.reloc..p............d..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsgE448.tmp\jsis.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):131000
                                                                                                                                                              Entropy (8bit):6.318881187824438
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:4B27DF9758C01833E92C51C24CE9E1D5
                                                                                                                                                              SHA1:C3E227564DE6808E542D2A91BBC70653CF88D040
                                                                                                                                                              SHA-256:D37408F77B7A4E7C60800B6D60C47305B487E8E21C82A416784864BD9F26E7BB
                                                                                                                                                              SHA-512:666F1B99D65169EC5B8BC41CDBBC5FE06BCB9872B7D628CB5ECE051630A38678291DDC84862101C727F386C75B750C067177E6E67C1F69AB9F5C2E24367659F4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c.Q.'.?.'.?.'.?.....4.?.'.>...?...;.2.?...?.&.?.....&.?...=.&.?.Rich'.?.................PE..L...^<.e...........!......................... ............................... ......\.....@......................... #......`6......................H...p)..........."..T............................................ ...............................text............................... ..`.rdata..@%... ...&..................@..@.data........P.......8..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsgE448.tmp\jsisdl.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):26048
                                                                                                                                                              Entropy (8bit):6.733118892769737
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:7100B585987B70E4F85686E78C52F283
                                                                                                                                                              SHA1:DBC2358993F73A97897815A8524804FB692C6165
                                                                                                                                                              SHA-256:937DCAF57370AF649133E5F48AAFED6E25345C93D599A981ACA520CE6DA8C1C0
                                                                                                                                                              SHA-512:739A2190659FE679721D5D4F8D6C0913B1BB54D44C67B6620B52D49B3D42C692D80A0C5358BFA480EB348F6D2B36125CD2D9563EFF3EC49F17008EDE671C688F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9]..X3.X3.X3. ..X3.X2.X3.?1;.X3.?13.X3.?1..X3.?11.X3.Rich.X3.........PE..L.....b^...........!.........R.......%.......0............................................@..........................0..d....2..P...................H<..x)...........0..T............................................0...............................text............................... ..`.rdata.......0......."..............@..@.data....D...@.......(..............@....rsrc................4..............@..@.reloc...............8..............@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsgE448.tmp\nsJSON.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37816
                                                                                                                                                              Entropy (8bit):6.720901390358665
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:DDB56A646AEA54615B29CE7DF8CD31B8
                                                                                                                                                              SHA1:0EA1A1528FAAFD930DDCEB226D9DEAF4FA53C8B2
                                                                                                                                                              SHA-256:07E602C54086A8FA111F83A38C2F3EE239F49328990212C2B3A295FADE2B5069
                                                                                                                                                              SHA-512:5D5D6EE7AC7454A72059BE736EC8DA82572F56E86454C5CBFE26E7956752B6DF845A6B0FADA76D92473033CA68CD9F87C8E60AC664320B015BB352915ABE33C8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........>E..P...P...P.......P...Q...P...X...P...P...P.......P...R...P.Rich..P.................PE..L....6.a...........!.....H...........*.......`......................................@M....@.........................pi..H....l..d...................Hj..p)...........i..T............................................`...............................text...AF.......H.................. ..`.rdata.......`.......L..............@..@.data...$............^..............@....rsrc................`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsgE448.tmp\reboot.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):27064
                                                                                                                                                              Entropy (8bit):6.8535675527340505
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0F3432346A273777B5F4D2E6A3BCA343
                                                                                                                                                              SHA1:F1042C066712444F12300F03892D4437C1CCA00A
                                                                                                                                                              SHA-256:4853D61601A860C628771993F3A57B5AB842C88D696235FEBFAA3CD890EBCD1E
                                                                                                                                                              SHA-512:50F769A888CD9C732D334818549A66A2894D18756E1A142B1C7593224A1BB310E59C611B6A9E12F5F4E76444F0DB0C54CF61D0D660740107300A2F245C680A49
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.0.>f^.>f^.>f^.7...7f^.>f_. f^...Z.8f^...^.?f^.....?f^...\.?f^.Rich>f^.........PE..L...c.b^...........!.....*...........4.......@......................................7.....@..........................@..`....B..d....`..............H@..p)...p.. ....@..T............................................@...............................text....(.......*.................. ..`.rdata.......@......................@..@.data...0....P.......4..............@....rsrc........`.......8..............@..@.reloc.. ....p.......<..............@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsgE448.tmp\sciterui.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):6762424
                                                                                                                                                              Entropy (8bit):6.865131932753362
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F40C5626532C77B9B4A6BB384DB48BBE
                                                                                                                                                              SHA1:D3124B356F6495288FC7FF1785B1932636BA92D3
                                                                                                                                                              SHA-256:E6D594047DEECB0F3D49898475084D286072B6E3E4A30EB9D0D03E9B3228D60F
                                                                                                                                                              SHA-512:8EABF1F5F6561A587026A30258C959A6B3AA4FA2A2D5A993FCD7069BFF21B1C25A648FEEA0AC5896ADCF57414308644AC48A4FF4BDC3A5D6E6B91BC735DC1056
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h..............|~..............|......Rich............PE..L......e...........!..........g..............................................0g......0g...@.......................................... ..x.g.........H.g.p)..............T............................................................................rdata..............................@..@.rsrc...x.g.. ....g.................@..@.......e........_...T...T..........e...........................e........T...........RSDS..s.p..N.jA.\.f.....D:\work\d58bb94b48143cdc\Contrib\build\out\x86\MinSizeRel\sciterui.pdb..............................T....rdata..T........rdata$zzzdbg.... ..P....rsrc$01....P!..(.g..rsrc$02................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsgE448.tmp\thirdparty.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):96184
                                                                                                                                                              Entropy (8bit):6.546739426752975
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:070335E8E52A288BDB45DB1C840D446B
                                                                                                                                                              SHA1:9DB1BE3D0AB572C5E969FEA8D38A217B4D23CAB2
                                                                                                                                                              SHA-256:C8CF0CF1C2B8B14CBEDFE621D81A79C80D70F587D698AD6DFB54BBE8E346FBBC
                                                                                                                                                              SHA-512:6F49B82C5DBB84070794BAE21B86E39D47F1A133B25E09F6A237689FD58B7338AE95440AE52C83FDA92466D723385A1CEAF335284D4506757A508ABFF9D4B44C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........f......................................................,.......,......,.......................................Rich............PE..L....d._...........!.................g..............................................?.....@......................... >..|....?......................HN..p)......`....6..T...........................(7..@...............t............................text............................... ..`.rdata...g.......h..................@..@.data....2...P.......0..............@....rsrc................8..............@..@.reloc..`............<..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nslE3D9.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):17228491
                                                                                                                                                              Entropy (8bit):5.323805341607517
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:8D5079507D1F0D04C8F0F5D42128F6AD
                                                                                                                                                              SHA1:2D1873EE2C3D606767CA64717203F4C40909381F
                                                                                                                                                              SHA-256:ECC6577926DD45417063BA8A76108952D051F4003C19458DC992BC46B2947930
                                                                                                                                                              SHA-512:D8AE0757A6092DCF7F161551978A6C0C20A1831177358EB17B1AC0BDE936C818CC580D42EA827F91A1D88704E9D2FA526F03EB6CC989167DB4AF1E72C033509D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.qs.....,...................n{...a......=s.,....qs..............................................................i...o..{o...o..................................................................................................................................................................................j...............................................................................................................................G.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nslF166.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\ajF04F.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):18910314
                                                                                                                                                              Entropy (8bit):5.639066993104128
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:9DBCD02B6334B356105098CAA4CFC927
                                                                                                                                                              SHA1:5F393D6DE6892825E27A0EA2DDABF2C9B19EB4B0
                                                                                                                                                              SHA-256:4F7AC04E6948D751AD49F5CD8ED548BF1ABFC132BF540A2324D6E43625EA7909
                                                                                                                                                              SHA-512:0A6836317F00099CA57786636C2A48FAA111927BFC6E7C6B0758C11F17508F31C46EE3BEE2412F817878F3C7F6455868FB11D46DDF6EA09CF6B4F190023BB338
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.qs.....,...................n{...a......=s.,....qs..............................................................i...o..{o...o..................................................................................................................................................................................j...............................................................................................................................G.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\ajF04F.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1688480
                                                                                                                                                              Entropy (8bit):7.938697411754708
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:9750EA6C750629D2CA971AB1C074DC9D
                                                                                                                                                              SHA1:7DF3D1615BEC8F5DA86A548F45F139739BDE286B
                                                                                                                                                              SHA-256:CD1C5C7635D7E4E56287F87588DEA791CF52B8D49AE599B60EFB1B4C3567BC9C
                                                                                                                                                              SHA-512:2ECBE819085BB9903A1A1FB6C796AD3B51617DD1FD03234C86E7D830B32A11FBCBFF6CDC0191180D368497DE2102319B0F56BFD5D8AC06D4F96585164801A04B
                                                                                                                                                              Malicious:true
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......].T...:...:...:...9...:...?...:...>...:.K.>...:.K.9...:.K.?.).:.A.3...:...;...:...;.n.:.A....:......:.A.8...:.Rich..:.................PE..L...p*.e.................n...........R............@.................................+/....@.....................................x.... ...[..........H`..Xc..............T...........................0...@............................................text....m.......n.................. ..`.rdata..Fr.......t...r..............@..@.data...............................@....rsrc....[... ...\..................@..@.reloc...............L..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AccessControl.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\ajF04F.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):27064
                                                                                                                                                              Entropy (8bit):6.671782479119062
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:C36EB8336B91D277DFA8575EB00D6364
                                                                                                                                                              SHA1:9EC81B49E7675548449E010950BC50BFF7CBC960
                                                                                                                                                              SHA-256:4336E05960FEE8C775B343209911F14ACBFDDE1E8D5AA9D1F0EA680FB4407307
                                                                                                                                                              SHA-512:0ABE6E367D1C934FEC8A89617B5FBFEA5AB7F8E557ADA7A667AEDB495F637C8782A2F4723C2D68B9EDAE4F426DEB5BBC0536F643FC65ECC2CD33295078474394
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9[..X5.X5.X5. ..X5.X4..X5.?1<.X5.?15.X5.?1..X5.?17.X5.Rich.X5.........PE..L...BcL^...........!......... .......*.......0............................................@.........................p<......|@..P....`..............H@..p)...p.......<..T............................................0...............................text...I........................... ..`.rdata.......0....... ..............@..@.data...L....P.......6..............@....rsrc........`.......8..............@..@.reloc.......p.......<..............@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\CR.History.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\ajF04F.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):155648
                                                                                                                                                              Entropy (8bit):0.5407252242845243
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                              SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                              SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                              SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\FF.places.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\ajF04F.exe
                                                                                                                                                              File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):5242880
                                                                                                                                                              Entropy (8bit):0.03859996294213402
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:D2A38A463B7925FE3ABE31ECCCE66ACA
                                                                                                                                                              SHA1:A1824888F9E086439B287DEA497F660F3AA4B397
                                                                                                                                                              SHA-256:474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
                                                                                                                                                              SHA-512:62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\JsisPlugins.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\ajF04F.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2179520
                                                                                                                                                              Entropy (8bit):6.773779547617883
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:BD94620C8A3496F0922D7A443C750047
                                                                                                                                                              SHA1:23C4CB2B4D5F5256E76E54969E7E352263ABF057
                                                                                                                                                              SHA-256:C0AF9E25C35650F43DE4E8A57BB89D43099BEEAD4CA6AF6BE846319FF84D7644
                                                                                                                                                              SHA-512:954006D27ED365FDF54327D64F05B950C2F0881E395257B87BA8E4CC608EC4771DEB490D57DC988571A2E66F730E04E8FE16F356A06070ABDA1DE9F3B0C3DA68
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........................."................................C.................................................f.........Rich...................PE..L......e...........!.........B......Ht........................................!.....[.!...@......................... ................@ .8...........H.!.x)...P .t!...{..T....................|.......{..@............... ............................text............................... ..`.rdata...'.......(..................@..@.data...h....@.......*..............@....rsrc...8....@ .....................@..@.reloc..t!...P .."..................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\Midex.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\ajF04F.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129976
                                                                                                                                                              Entropy (8bit):6.690073972113693
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:581C4A0B8DE60868B89074FE94EB27B9
                                                                                                                                                              SHA1:70B8BDFDDB08164F9D52033305D535B7DB2599F6
                                                                                                                                                              SHA-256:B13C23AF49DA0A21959E564CBCA8E6B94C181C5EEB95150B29C94FF6AFB8F9DD
                                                                                                                                                              SHA-512:94290E72871C622FC32E9661719066BAFB9B393E10ED397CAE8A6F0C8BE6ED0DF88E5414F39BC528BF9A81980BDCB621745B6C712F4878F0447595CEC59EE33D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................\P5.....\P7....\P6........................W............r.......r.......r.;.......S.....r.......Rich....................PE..L....lL^...........!.....:...........E.......P............................... ......9.....@.........................0...D...t...<...................H...p).......... ...T...........................x...@............P..L............................text....9.......:.................. ..`.rdata...p...P...r...>..............@..@.data...t...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\StdUtils.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\ajF04F.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):200632
                                                                                                                                                              Entropy (8bit):6.691052135878374
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:7602B88D488E54B717A7086605CD6D8D
                                                                                                                                                              SHA1:C01200D911E744BDFFA7F31B3C23068971494485
                                                                                                                                                              SHA-256:2640E4F09AA4C117036BFDDD12DC02834E66400392761386BD1FE172A6DDFA11
                                                                                                                                                              SHA-512:A11B68BDAECC1FE3D04246CFD62DD1BB4EF5F360125B40DADF8D475E603E14F24CF35335E01E985F0E7ADCF785FDF6C57C7856722BC8DCB4DD2A1F817B1DDE3A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........f.................................x...g,.....,.......,.................a..........,......e......e.......e...............e.......Rich....................PE..L.....l^...........!................\........0............................... ............@............................T...$.......................H...p)..........0...T...................,...........@............0...............................text...8........................... ..`.rdata.......0......................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\inetc.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\ajF04F.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):38336
                                                                                                                                                              Entropy (8bit):6.325196542922235
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5C40A7C1A2965CF7CAEFACA2FC299985
                                                                                                                                                              SHA1:2220A643392893A2B9F31DB58AE2F21B398FB26F
                                                                                                                                                              SHA-256:0935C1CBA93551B6E856ECE274CBB71CE93CCC7507C0CCD2EC08A3A32BDB6915
                                                                                                                                                              SHA-512:58C5BFF3A3D25FC4426F473D53D0F0A36CC251D71EF34103186E7BC0F4E80B659E86EDC5AE798BE2DCEA2D4573C575652FC385BE9577EB5E6C82B3473B2003D0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>...z.q,z.q,z.q,...,s.q,z.p,/.q,..t-x.q,..u-{.q,..q-{.q,...,{.q,..s-{.q,Richz.q,........................PE..L...B.b^...........!.....6...|.......2.......P......................................0.....@..........................W..l...xY..d...................Hl..x)......p...PW..T............................................P..p............................text....4.......6.................. ..`.rdata.......P.......:..............@..@.data....V...p.......L..............@....rsrc................Z..............@..@.reloc..p............d..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\jsis.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\ajF04F.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):131000
                                                                                                                                                              Entropy (8bit):6.318881187824438
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:4B27DF9758C01833E92C51C24CE9E1D5
                                                                                                                                                              SHA1:C3E227564DE6808E542D2A91BBC70653CF88D040
                                                                                                                                                              SHA-256:D37408F77B7A4E7C60800B6D60C47305B487E8E21C82A416784864BD9F26E7BB
                                                                                                                                                              SHA-512:666F1B99D65169EC5B8BC41CDBBC5FE06BCB9872B7D628CB5ECE051630A38678291DDC84862101C727F386C75B750C067177E6E67C1F69AB9F5C2E24367659F4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c.Q.'.?.'.?.'.?.....4.?.'.>...?...;.2.?...?.&.?.....&.?...=.&.?.Rich'.?.................PE..L...^<.e...........!......................... ............................... ......\.....@......................... #......`6......................H...p)..........."..T............................................ ...............................text............................... ..`.rdata..@%... ...&..................@..@.data........P.......8..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\jsisdl.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\ajF04F.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):26048
                                                                                                                                                              Entropy (8bit):6.733118892769737
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:7100B585987B70E4F85686E78C52F283
                                                                                                                                                              SHA1:DBC2358993F73A97897815A8524804FB692C6165
                                                                                                                                                              SHA-256:937DCAF57370AF649133E5F48AAFED6E25345C93D599A981ACA520CE6DA8C1C0
                                                                                                                                                              SHA-512:739A2190659FE679721D5D4F8D6C0913B1BB54D44C67B6620B52D49B3D42C692D80A0C5358BFA480EB348F6D2B36125CD2D9563EFF3EC49F17008EDE671C688F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9]..X3.X3.X3. ..X3.X2.X3.?1;.X3.?13.X3.?1..X3.?11.X3.Rich.X3.........PE..L.....b^...........!.........R.......%.......0............................................@..........................0..d....2..P...................H<..x)...........0..T............................................0...............................text............................... ..`.rdata.......0......."..............@..@.data....D...@.......(..............@....rsrc................4..............@..@.reloc...............8..............@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\nsJSON.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\ajF04F.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37816
                                                                                                                                                              Entropy (8bit):6.720901390358665
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:DDB56A646AEA54615B29CE7DF8CD31B8
                                                                                                                                                              SHA1:0EA1A1528FAAFD930DDCEB226D9DEAF4FA53C8B2
                                                                                                                                                              SHA-256:07E602C54086A8FA111F83A38C2F3EE239F49328990212C2B3A295FADE2B5069
                                                                                                                                                              SHA-512:5D5D6EE7AC7454A72059BE736EC8DA82572F56E86454C5CBFE26E7956752B6DF845A6B0FADA76D92473033CA68CD9F87C8E60AC664320B015BB352915ABE33C8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........>E..P...P...P.......P...Q...P...X...P...P...P.......P...R...P.Rich..P.................PE..L....6.a...........!.....H...........*.......`......................................@M....@.........................pi..H....l..d...................Hj..p)...........i..T............................................`...............................text...AF.......H.................. ..`.rdata.......`.......L..............@..@.data...$............^..............@....rsrc................`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\reboot.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\ajF04F.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):27064
                                                                                                                                                              Entropy (8bit):6.8535675527340505
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0F3432346A273777B5F4D2E6A3BCA343
                                                                                                                                                              SHA1:F1042C066712444F12300F03892D4437C1CCA00A
                                                                                                                                                              SHA-256:4853D61601A860C628771993F3A57B5AB842C88D696235FEBFAA3CD890EBCD1E
                                                                                                                                                              SHA-512:50F769A888CD9C732D334818549A66A2894D18756E1A142B1C7593224A1BB310E59C611B6A9E12F5F4E76444F0DB0C54CF61D0D660740107300A2F245C680A49
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.0.>f^.>f^.>f^.7...7f^.>f_. f^...Z.8f^...^.?f^.....?f^...\.?f^.Rich>f^.........PE..L...c.b^...........!.....*...........4.......@......................................7.....@..........................@..`....B..d....`..............H@..p)...p.. ....@..T............................................@...............................text....(.......*.................. ..`.rdata.......@......................@..@.data...0....P.......4..............@....rsrc........`.......8..............@..@.reloc.. ....p.......<..............@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\remoteResponse.json

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\ajF04F.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):875
                                                                                                                                                              Entropy (8bit):4.6554579552778055
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0426152C1853F7765CF429A203B1B7C9
                                                                                                                                                              SHA1:6D5321F116B6A531BF4C8A4C1D8CFD02B1BB511B
                                                                                                                                                              SHA-256:1FAC3BFC9A06359066513817A9285EE4FEFF15EE91A74F0B4A97B10AE13A5508
                                                                                                                                                              SHA-512:DD6AF8DF3763A87086FA664B96E650EAA7E51B51946A0D278C2BBF04C86F5179E59AC80DC30F96D9868CECBBCA96063B9D3FB67EEFCC72E186A57578B1F4D510
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"av_extensions_native":"lhnnoklckomcfdlknmjaenoodlpfdclc,dmfdacibleoapmpfdgonigdfinmekhgp","campaign_group_id":"100","campaign_id":"9249","country_code":"US","enable_repair_in_uninstall":"0","installer_silent":"1","register_install":1,"remote_disable":"0","request_uuid":"5fc16528fbfb4e14b8b495e2ff6f8ae7","search_provider":"bing.com","setting_enable_bankmode":"1","setting_force_default_win10":"1","setting_heartbeat_install":1,"setting_hide_uninstall":"0","setting_import_cookies":"1","setting_import_settings":"2","setting_install_background":"1","setting_launch_install":"1","setting_launch_logon":"1","setting_make_default":"1","setting_make_default_cbox_page":"options","setting_popular_shortcuts_v2":"0","setting_shortcut_desktop":"1","setting_shortcut_startmenu":"1","setting_shortcut_taskbar":"1","update_retries":2,"utc_date":"20240603","utc_timestamp":1717427701}

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\sciterui.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\ajF04F.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):6762424
                                                                                                                                                              Entropy (8bit):6.865131932753362
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F40C5626532C77B9B4A6BB384DB48BBE
                                                                                                                                                              SHA1:D3124B356F6495288FC7FF1785B1932636BA92D3
                                                                                                                                                              SHA-256:E6D594047DEECB0F3D49898475084D286072B6E3E4A30EB9D0D03E9B3228D60F
                                                                                                                                                              SHA-512:8EABF1F5F6561A587026A30258C959A6B3AA4FA2A2D5A993FCD7069BFF21B1C25A648FEEA0AC5896ADCF57414308644AC48A4FF4BDC3A5D6E6B91BC735DC1056
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h..............|~..............|......Rich............PE..L......e...........!..........g..............................................0g......0g...@.......................................... ..x.g.........H.g.p)..............T............................................................................rdata..............................@..@.rsrc...x.g.. ....g.................@..@.......e........_...T...T..........e...........................e........T...........RSDS..s.p..N.jA.\.f.....D:\work\d58bb94b48143cdc\Contrib\build\out\x86\MinSizeRel\sciterui.pdb..............................T....rdata..T........rdata$zzzdbg.... ..P....rsrc$01....P!..(.g..rsrc$02................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\thirdparty.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\ajF04F.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):96184
                                                                                                                                                              Entropy (8bit):6.546739426752975
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:070335E8E52A288BDB45DB1C840D446B
                                                                                                                                                              SHA1:9DB1BE3D0AB572C5E969FEA8D38A217B4D23CAB2
                                                                                                                                                              SHA-256:C8CF0CF1C2B8B14CBEDFE621D81A79C80D70F587D698AD6DFB54BBE8E346FBBC
                                                                                                                                                              SHA-512:6F49B82C5DBB84070794BAE21B86E39D47F1A133B25E09F6A237689FD58B7338AE95440AE52C83FDA92466D723385A1CEAF335284D4506757A508ABFF9D4B44C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........f......................................................,.......,......,.......................................Rich............PE..L....d._...........!.................g..............................................?.....@......................... >..|....?......................HN..p)......`....6..T...........................(7..@...............t............................text............................... ..`.rdata...g.......h..................@..@.data....2...P.......0..............@....rsrc................8..............@..@.reloc..`............<..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{1FF43E4D-AA88-4479-9A55-5241D9C8AAC8}-AVGBrowserInstaller.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):117845816
                                                                                                                                                              Entropy (8bit):7.99995911243968
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:371F796FCFD9D0BA16C7DA57487323A0
                                                                                                                                                              SHA1:87264EF1B5C17CC39843D4A70B8A2B36575462F8
                                                                                                                                                              SHA-256:C7B20321E1E02F65388121FF44C0F385F3165D3B6933432FE69177F8D1B288D2
                                                                                                                                                              SHA-512:DB42B34DFA253C51F386DD45AC99A5FD48A6502FDD1EFF842C406672BC1593274A348667B093E5826439A054A74E8DDABFE652FC79BE0AD5F75C6CDE1E3D7FAF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....;f.........."..........&.................@.....................................j....`.................................................xG..P............p......HZ..........$....F...............................@..8............I...............................text....-.......................... ..`.rdata.......@.......2..............@..@.data...@....`.......D..............@....pdata.......p.......F..............@..@.retplne.............J...................rsrc................L..............@..@.reloc..$............X..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{DF5A446B-D24D-4C0E-B25C-417D247911DA}\scrt.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):5927640
                                                                                                                                                              Entropy (8bit):6.592091853347423
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F36F05628B515262DB197B15C7065B40
                                                                                                                                                              SHA1:74A8005379F26DD0DE952ACAB4E3FC5459CDE243
                                                                                                                                                              SHA-256:67ABD9E211B354FA222E7926C2876C4B3A7ACA239C0AF47C756EE1B6DB6E6D31
                                                                                                                                                              SHA-512:280390B1CF1B6B1E75EAA157ADAF89135963D366B48686D48921A654527F9C1505C195CA1FC16DC85B8F13B2994841CA7877A63AF708883418A1D588AFA3DBE8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......Z.5...[Q..[Q..[Q.3.Q..[Q.3.Q..[Q.3.Q4.[Q...Q..[QL.XP..[QL.^Pe.[QL._P8.[Q<.]P..[Q<.^P..[Q<.ZP1.[Q..ZQ..[Q..RP.[Q..[P..[Q..Q..[Q...Q..[Q..YP..[QRich..[Q................PE..L......_...........!......>..nE.....(W6...... >.....................................tX[...@..........................3O.H...84O...... {..3...........\Z......`...<...gH.p....................iH.....`hH.@............ >..............................text...a.>.......>................. ..`.rdata...K... >..L....>.............@..@.data...D.+..pO......\O.............@....rsrc....3... {..4....Q.............@..@.reloc...<...`...>....V.............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Windows\Installer\5d2f0a.msi

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                              File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: AVG Update Helper, Author: AVG Technologies, Keywords: Installer, Comments: (C) 2017-2024 Gen Digital Inc., Template: Intel;1033, Revision Number: {A87CFB5C-61CB-4FE0-9552-F287D1928D95}, Create Time/Date: Thu Mar 21 12:47:58 2024, Last Saved Time/Date: Thu Mar 21 12:47:58 2024, Number of Pages: 300, Number of Words: 0, Name of Creating Application: Windows Installer XML Toolset (3.11.1.2318), Security: 2
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):32768
                                                                                                                                                              Entropy (8bit):3.7109485435414107
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:66140E921FFC869E5DBD7D0337503F1A
                                                                                                                                                              SHA1:CC26B0818DBB2A4D3E242FD1CAF7B45E036961C0
                                                                                                                                                              SHA-256:D2EF84B42A4358E58F5566D842C389B229BA073FCEF20B2A3007B6CE76A06D2B
                                                                                                                                                              SHA-512:EB4A787E76A6700112349B5EBA78A4467BA4A2364D30EADE70ACBA480E4DF1C5D48BCB31CA136F81B350C466911AF97CB1DA1BA964C2D35003A4E3E86C738772
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Windows\Installer\5d2f0d.msi

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                              File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: AVG Update Helper, Author: AVG Technologies, Keywords: Installer, Comments: (C) 2017-2024 Gen Digital Inc., Template: Intel;1033, Revision Number: {A87CFB5C-61CB-4FE0-9552-F287D1928D95}, Create Time/Date: Thu Mar 21 12:47:58 2024, Last Saved Time/Date: Thu Mar 21 12:47:58 2024, Number of Pages: 300, Number of Words: 0, Name of Creating Application: Windows Installer XML Toolset (3.11.1.2318), Security: 2
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):32768
                                                                                                                                                              Entropy (8bit):3.7109485435414107
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:66140E921FFC869E5DBD7D0337503F1A
                                                                                                                                                              SHA1:CC26B0818DBB2A4D3E242FD1CAF7B45E036961C0
                                                                                                                                                              SHA-256:D2EF84B42A4358E58F5566D842C389B229BA073FCEF20B2A3007B6CE76A06D2B
                                                                                                                                                              SHA-512:EB4A787E76A6700112349B5EBA78A4467BA4A2364D30EADE70ACBA480E4DF1C5D48BCB31CA136F81B350C466911AF97CB1DA1BA964C2D35003A4E3E86C738772
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Windows\Installer\MSI32A4.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1606
                                                                                                                                                              Entropy (8bit):5.712772428562859
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:5F7F62048A5E02E438F8DA61B0E73B34
                                                                                                                                                              SHA1:BC09DFDC21C2778B0F7C08C037E59749675B67C3
                                                                                                                                                              SHA-256:55D715980275BEA0BD26CCFC8C9276FB952814BDF187D65D16CA245496C2D4E5
                                                                                                                                                              SHA-512:9B1F8E54380D9E5070D1D09D6527FC929CA0A0720692B3A4D350791A7AB0366507B84E800BC575BBB19C135C6BC627BAAB0BB53DB1EFDFCF7E922279AB482DAB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:...@IXOS.@.....@.Y.X.@.....@.....@.....@.....@.....@......&.{EDB7AEE7-E932-4836-AE50-D3B0B7766CB5}..AVG Update Helper..AVGBrowserUpdateHelper.msi.@.....@.....@.....@........&.{A87CFB5C-61CB-4FE0-9552-F287D1928D95}.....@.....@.....@.....@.......@.....@.....@.......@......AVG Update Helper......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{717B7059-A988-492F-AF1B-DCF70BE809AB}*.02:\SOFTWARE\AVG\Browser\Update\MsiStubRun.@.......@.....@.....@........WriteRegistryValues..Writing system registry values..Key: [1], Name: [2], Value: [3]...@.....@.....@.3..$..@......SOFTWARE\AVG\Browser\Update...@....%...MsiStubRun..#0....RegisterProduct..Registering product..[1]......Please insert the disk: ..required.cab.@.....@......C:\Windows\Installer\5d2f0a.msi.........@....H...C:\Windows\Installer\5d2f0a.msi&.{EDB7AEE7-E932-4836-AE50-D3B0B7766CB5}..&.{9515FFBD-40AB-469

                                                                                                                                                              C:\Windows\Installer\SourceHash{EDB7AEE7-E932-4836-AE50-D3B0B7766CB5}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                              File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20480
                                                                                                                                                              Entropy (8bit):1.1700469680076062
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:659BEDBAFAFAAE17A8C0A59D6C986FC0
                                                                                                                                                              SHA1:DB0126440E9A9D1CEB3EBE6786DD3CB99F70E429
                                                                                                                                                              SHA-256:0A8D7C3A7CDDADB9DE42B40C6F881001AE655AF0BE0FE7A5EF53B4E5D78FC64A
                                                                                                                                                              SHA-512:7687C77BFB93C189A826C825D808A70D032B82E70E8076CC335B0359EE524A32C0015161FDB7CBAEC78EC5158D6F661D99B2A0C4F8345AC233BDE42E95265F98
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Windows\Installer\inprogressinstallinfo.ipi

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                              File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20480
                                                                                                                                                              Entropy (8bit):1.4486619084038037
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F7FFAD5B63001D6BA836102860914A5A
                                                                                                                                                              SHA1:34BE43633C03EC0680A4E74ED22FBD4111C29EB8
                                                                                                                                                              SHA-256:D07953F54561AAEA27ABCA6E26C8077A37F6BC3B7960E0C29DFB064CC607C162
                                                                                                                                                              SHA-512:9E77F858B4FC81F26565D5F3775BA307A35459056564CBB37AD39A59F7FC4BB99D9E7FD3D447F6B544A6527C31C9DE18BC0FD34CFAC9D7D4768A05854C0670DB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):364484
                                                                                                                                                              Entropy (8bit):5.365492836740699
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:8DB5F270614F97EB081ACD7DF6B3B94F
                                                                                                                                                              SHA1:0671B7D303B64DC7167721E8C4770DA601F41351
                                                                                                                                                              SHA-256:CAFA2E456545F2BECE1622203F4E928127836BC0C743CCE18EC0E252FA53752C
                                                                                                                                                              SHA-512:3D35D3928F2FC5C03893D3569ED59C31227A7D4C5DBA1619ED689B9508AB635880E44EF406ED29B9050E65716CFF223BEB79FC349A7D15A63075E970BDD9E2D2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

                                                                                                                                                              C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):55
                                                                                                                                                              Entropy (8bit):4.306461250274409
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                                                                                              SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                                                                                              SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                                                                                              SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                                                                                                                              C:\Windows\SystemTemp\Crashpad\settings.dat

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):40
                                                                                                                                                              Entropy (8bit):3.2954618442383206
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:DB7D530D34D1399F403F4601269F7BCD
                                                                                                                                                              SHA1:38B2CD3F23911434C4C44ACF9853ADBCD532C554
                                                                                                                                                              SHA-256:09A48FE1AECE348CBA1AF70B67F6B0D5353CB7B04C72D5C5DDF79AE7A7E1BE2F
                                                                                                                                                              SHA-512:A0AFEF7CC34431AD1CCAE5036E5FEEF7699686D290C5511B803B51C0D5923AF22408D3B7CB51A3429BD4F99848E48DAF703BE21D1A4BE0936506F7C1352098BE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:sdPC..................../..*. L..*..U..

                                                                                                                                                              C:\Windows\Temp\~DF17132DBE6FCC0918.TMP

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):512
                                                                                                                                                              Entropy (8bit):0.0
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                              SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                              SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                              SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Windows\Temp\~DF1F5FAFD771B599F1.TMP

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):512
                                                                                                                                                              Entropy (8bit):0.0
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                              SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                              SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                              SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Windows\Temp\~DF381A9187F13432EB.TMP

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                              File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):32768
                                                                                                                                                              Entropy (8bit):1.1685396858496686
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0F31774273E2FF419EC2D978B767F44D
                                                                                                                                                              SHA1:DDC550FD5FA85107B50010A7D94611BB361CC643
                                                                                                                                                              SHA-256:6261801F3A1B421AA011FA1D26C1B5D3E74924B8B5E49210C5942E1441CE60E0
                                                                                                                                                              SHA-512:8ECB77D44F07E6A83D74CC99701BA7F074BAD4DF7822FD1827EAC9B7F3833AF95409043F6EC112BB59F0B83276FEB9B249486E12412332D7DAD1B35B6C569E8E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Windows\Temp\~DF5749D651030E6146.TMP

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                              File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):32768
                                                                                                                                                              Entropy (8bit):1.1685396858496686
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0F31774273E2FF419EC2D978B767F44D
                                                                                                                                                              SHA1:DDC550FD5FA85107B50010A7D94611BB361CC643
                                                                                                                                                              SHA-256:6261801F3A1B421AA011FA1D26C1B5D3E74924B8B5E49210C5942E1441CE60E0
                                                                                                                                                              SHA-512:8ECB77D44F07E6A83D74CC99701BA7F074BAD4DF7822FD1827EAC9B7F3833AF95409043F6EC112BB59F0B83276FEB9B249486E12412332D7DAD1B35B6C569E8E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Windows\Temp\~DF70AA8FAA7EFBAEDC.TMP

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):32768
                                                                                                                                                              Entropy (8bit):0.07618458479323724
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:106D6986E85982E6BC027BB1F6111257
                                                                                                                                                              SHA1:019DFAA9711020513B93CDF1A42097E0D907BF32
                                                                                                                                                              SHA-256:35AEF4794BEDF15DF9113F53D79B910095636B5E138FE07E58555629065B8F9A
                                                                                                                                                              SHA-512:1B84E97E2BB30228B46B0F11EB9A971D79583DFF1EFEA22D83BCF2A8C724B216DA33BBC956769F1807AE5D038235F199ACCCA323843532D6A32AF570C45FF3E3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Windows\Temp\~DFA6E94AC9F5E7BBB9.TMP

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):69632
                                                                                                                                                              Entropy (8bit):0.097043450093419
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:557A2A78AD28F1094A24F993F836BBC1
                                                                                                                                                              SHA1:707A29DD9E6C5E5E4934C7A6EF5A931D8C634383
                                                                                                                                                              SHA-256:9AA0F31510DC6927A2BC329FB944714301C3199470E7E60B2DC685AD0C95B842
                                                                                                                                                              SHA-512:5DCB790A2812EABB21FF4B15441FF652FBB1740D74A7FE1C5BAD9051886CEB5FF9AEB30D63DE747C8157B8C3EE116EFAE2D9C83738CDF8D4BCB13BCB47CD7891
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Windows\Temp\~DFB3631F4319E40AAC.TMP

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                              File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):32768
                                                                                                                                                              Entropy (8bit):1.1685396858496686
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:0F31774273E2FF419EC2D978B767F44D
                                                                                                                                                              SHA1:DDC550FD5FA85107B50010A7D94611BB361CC643
                                                                                                                                                              SHA-256:6261801F3A1B421AA011FA1D26C1B5D3E74924B8B5E49210C5942E1441CE60E0
                                                                                                                                                              SHA-512:8ECB77D44F07E6A83D74CC99701BA7F074BAD4DF7822FD1827EAC9B7F3833AF95409043F6EC112BB59F0B83276FEB9B249486E12412332D7DAD1B35B6C569E8E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Windows\Temp\~DFBF006531AD9E5910.TMP

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                              File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20480
                                                                                                                                                              Entropy (8bit):1.4486619084038037
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F7FFAD5B63001D6BA836102860914A5A
                                                                                                                                                              SHA1:34BE43633C03EC0680A4E74ED22FBD4111C29EB8
                                                                                                                                                              SHA-256:D07953F54561AAEA27ABCA6E26C8077A37F6BC3B7960E0C29DFB064CC607C162
                                                                                                                                                              SHA-512:9E77F858B4FC81F26565D5F3775BA307A35459056564CBB37AD39A59F7FC4BB99D9E7FD3D447F6B544A6527C31C9DE18BC0FD34CFAC9D7D4768A05854C0670DB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Windows\Temp\~DFCA1B824199744B44.TMP

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                              File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20480
                                                                                                                                                              Entropy (8bit):1.4486619084038037
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:F7FFAD5B63001D6BA836102860914A5A
                                                                                                                                                              SHA1:34BE43633C03EC0680A4E74ED22FBD4111C29EB8
                                                                                                                                                              SHA-256:D07953F54561AAEA27ABCA6E26C8077A37F6BC3B7960E0C29DFB064CC607C162
                                                                                                                                                              SHA-512:9E77F858B4FC81F26565D5F3775BA307A35459056564CBB37AD39A59F7FC4BB99D9E7FD3D447F6B544A6527C31C9DE18BC0FD34CFAC9D7D4768A05854C0670DB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Windows\Temp\~DFF41A919B7568FECA.TMP

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):512
                                                                                                                                                              Entropy (8bit):0.0
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                              SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                              SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                              SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Windows\Temp\~DFFE59154A2CC6F39A.TMP

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):512
                                                                                                                                                              Entropy (8bit):0.0
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                              SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                              SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                              SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Windows\Temp\~DFFFA0E3BA18E25288.TMP

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):512
                                                                                                                                                              Entropy (8bit):0.0
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:
                                                                                                                                                              MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                              SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                              SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                              SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              Static File Info

                                                                                                                                                              General

                                                                                                                                                              File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                              Entropy (8bit):7.990489529157075
                                                                                                                                                              TrID:
                                                                                                                                                              • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                              • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                              • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                              File name:file.exe
                                                                                                                                                              File size:6'116'304 bytes
                                                                                                                                                              MD5:60feb08011db31607cee2a5bc1f2206f
                                                                                                                                                              SHA1:f8f680a3a8ca7eb2058eebdf2f25a95904780988
                                                                                                                                                              SHA256:20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2
                                                                                                                                                              SHA512:71db5d12fd3717085b67fe93b671e0f5f7124e1cc3141197572666bc2f914c9b67ba661d49007ea05c7b0cf05345e376ec3894af6696d120957dbb6ce32d3a87
                                                                                                                                                              SSDEEP:98304:49Aqm4Riz+Hbw3PR/eqltg9yLcYGgtf2euoelboe2u+8zBfjjGMfLrmdxiW4KTmA:lqxRii7AoyLVG8XuoelbT2+bK2rmdADK
                                                                                                                                                              TLSH:4956333D8AD84A26F0BBCF3096B25B875C657E12AC31CDAC4187025E0C35616F9E93B7
                                                                                                                                                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........18..PV..PV..PV.*_...PV..PW.MPV.*_...PV..sf..PV..VP..PV.Rich.PV.........PE..L......].................f...*.......5............@

                                                                                                                                                              File Icon

                                                                                                                                                              Icon Hash:07336969714d4b4e

                                                                                                                                                              Static PE Info

                                                                                                                                                              General

                                                                                                                                                              Entrypoint:0x40350d
                                                                                                                                                              Entrypoint Section:.text
                                                                                                                                                              Digitally signed:true
                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                              Subsystem:windows gui
                                                                                                                                                              Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                                                                                              DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                                                              Time Stamp:0x5DF6D4ED [Mon Dec 16 00:50:53 2019 UTC]
                                                                                                                                                              TLS Callbacks:
                                                                                                                                                              CLR (.Net) Version:
                                                                                                                                                              OS Version Major:4
                                                                                                                                                              OS Version Minor:0
                                                                                                                                                              File Version Major:4
                                                                                                                                                              File Version Minor:0
                                                                                                                                                              Subsystem Version Major:4
                                                                                                                                                              Subsystem Version Minor:0
                                                                                                                                                              Import Hash:24f4223e271413c25abad52fd456a9bc

                                                                                                                                                              Authenticode Signature

                                                                                                                                                              Signature Valid:true
                                                                                                                                                              Signature Issuer:CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
                                                                                                                                                              Signature Validation Error:The operation completed successfully
                                                                                                                                                              Error Number:0
                                                                                                                                                              Not Before, Not After
                                                                                                                                                              • 16/09/2022 02:00:00 18/09/2025 01:59:59
                                                                                                                                                              Subject Chain
                                                                                                                                                              • CN="AVG Technologies USA, LLC", O="AVG Technologies USA, LLC", L=Redwood City, S=California, C=US
                                                                                                                                                              Version:3
                                                                                                                                                              Thumbprint MD5:A1611C3679916473A418093E16AEDD48
                                                                                                                                                              Thumbprint SHA-1:79A1F7262575EC7D1304F9CDAC161C91DA814B87
                                                                                                                                                              Thumbprint SHA-256:EF742180FB09007A9E14469292CCC7A0E2E63EB33336A03DFA293EB5EE954E49
                                                                                                                                                              Serial:0435603F7A888AE16C05B00F153CC6FC

                                                                                                                                                              Entrypoint Preview

                                                                                                                                                              Instruction
                                                                                                                                                              sub esp, 000002D4h
                                                                                                                                                              push ebx
                                                                                                                                                              push esi
                                                                                                                                                              push edi
                                                                                                                                                              push 00000020h
                                                                                                                                                              pop edi
                                                                                                                                                              xor ebx, ebx
                                                                                                                                                              push 00008001h
                                                                                                                                                              mov dword ptr [esp+14h], ebx
                                                                                                                                                              mov dword ptr [esp+10h], 0040A230h
                                                                                                                                                              mov dword ptr [esp+1Ch], ebx
                                                                                                                                                              call dword ptr [004080ACh]
                                                                                                                                                              call dword ptr [004080A8h]
                                                                                                                                                              and eax, BFFFFFFFh
                                                                                                                                                              cmp ax, 00000006h
                                                                                                                                                              mov dword ptr [0042A24Ch], eax
                                                                                                                                                              je 00007FEF94C786C3h
                                                                                                                                                              push ebx
                                                                                                                                                              call 00007FEF94C7B997h
                                                                                                                                                              cmp eax, ebx
                                                                                                                                                              je 00007FEF94C786B9h
                                                                                                                                                              push 00000C00h
                                                                                                                                                              call eax
                                                                                                                                                              mov esi, 004082B0h
                                                                                                                                                              push esi
                                                                                                                                                              call 00007FEF94C7B911h
                                                                                                                                                              push esi
                                                                                                                                                              call dword ptr [00408154h]
                                                                                                                                                              lea esi, dword ptr [esi+eax+01h]
                                                                                                                                                              cmp byte ptr [esi], 00000000h
                                                                                                                                                              jne 00007FEF94C7869Ch
                                                                                                                                                              push 0000000Ah
                                                                                                                                                              call 00007FEF94C7B96Ah
                                                                                                                                                              push 00000008h
                                                                                                                                                              call 00007FEF94C7B963h
                                                                                                                                                              push 00000006h
                                                                                                                                                              mov dword ptr [0042A244h], eax
                                                                                                                                                              call 00007FEF94C7B957h
                                                                                                                                                              cmp eax, ebx
                                                                                                                                                              je 00007FEF94C786C1h
                                                                                                                                                              push 0000001Eh
                                                                                                                                                              call eax
                                                                                                                                                              test eax, eax
                                                                                                                                                              je 00007FEF94C786B9h
                                                                                                                                                              or byte ptr [0042A24Fh], 00000040h
                                                                                                                                                              push ebp
                                                                                                                                                              call dword ptr [00408040h]
                                                                                                                                                              push ebx
                                                                                                                                                              call dword ptr [0040829Ch]
                                                                                                                                                              mov dword ptr [0042A318h], eax
                                                                                                                                                              push ebx
                                                                                                                                                              lea eax, dword ptr [esp+34h]
                                                                                                                                                              push 000002B4h
                                                                                                                                                              push eax
                                                                                                                                                              push ebx
                                                                                                                                                              push 004216E8h
                                                                                                                                                              call dword ptr [00408184h]
                                                                                                                                                              push 0040A384h

                                                                                                                                                              Rich Headers

                                                                                                                                                              Programming Language:
                                                                                                                                                              • [EXP] VC++ 6.0 SP5 build 8804

                                                                                                                                                              Data Directories

                                                                                                                                                              NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0x85040xa0.rdata
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0x8a0000x20be8.rsrc
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x5d2a180x29b8
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_IAT0x80000x2ac.rdata
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                              Sections

                                                                                                                                                              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                              .text0x10000x647b0x6600126ee0e9857c3dd1da49a87c83cf68a5False0.6578967524509803data6.426522741823245IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                              .rdata0x80000x13840x1400c0b38cbc803107c82ebed5a1c15c1ffaFalse0.45data5.136348990166042IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                              .data0xa0000x203580x6009e607f846cdaf2d9c5b82d7d05f433acFalse0.5032552083333334data4.005849468822358IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                              .ndata0x2b0000x5f0000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                              .rsrc0x8a0000x20be80x20c00366befd0e6e7b858479c47dcd6e974a4False0.36560710877862596data5.717909981456929IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                              Resources

                                                                                                                                                              NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                              RT_ICON0x8ab800x7d11PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.9981572289721086
                                                                                                                                                              RT_ICON0x928980x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/mEnglishUnited States0.3860995850622407
                                                                                                                                                              RT_ICON0x94e400x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/mEnglishUnited States0.5056285178236398
                                                                                                                                                              RT_ICON0x95ee80xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2835 x 2835 px/m, 256 important colorsEnglishUnited States0.4978678038379531
                                                                                                                                                              RT_ICON0x96d900x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2835 x 2835 px/m, 256 important colorsEnglishUnited States0.5870938628158845
                                                                                                                                                              RT_ICON0x976380x668Device independent bitmap graphic, 48 x 96 x 4, image size 1152, resolution 2835 x 2835 px/m, 16 important colorsEnglishUnited States0.37865853658536586
                                                                                                                                                              RT_ICON0x97ca00x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2835 x 2835 px/m, 256 important colorsEnglishUnited States0.6235549132947977
                                                                                                                                                              RT_ICON0x982080x468Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/mEnglishUnited States0.7606382978723404
                                                                                                                                                              RT_ICON0x986700x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512, resolution 2835 x 2835 px/m, 16 important colorsEnglishUnited States0.5497311827956989
                                                                                                                                                              RT_ICON0x989580x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, resolution 2835 x 2835 px/m, 16 important colorsEnglishUnited States0.7905405405405406
                                                                                                                                                              RT_DIALOG0x98a800x100dataEnglishUnited States0.5234375
                                                                                                                                                              RT_DIALOG0x98b800x11cdataEnglishUnited States0.6056338028169014
                                                                                                                                                              RT_DIALOG0x98ca00x60dataEnglishUnited States0.7291666666666666
                                                                                                                                                              RT_DIALOG0x98d000x100dataEnglishUnited States0.55859375
                                                                                                                                                              RT_DIALOG0x98e000x11cdataEnglishUnited States0.6408450704225352
                                                                                                                                                              RT_DIALOG0x98f200x60dataEnglishUnited States0.7916666666666666
                                                                                                                                                              RT_DIALOG0x98f800x100dataEnglishUnited States0.55859375
                                                                                                                                                              RT_DIALOG0x990800x11cdataEnglishUnited States0.6408450704225352
                                                                                                                                                              RT_DIALOG0x991a00x60dataEnglishUnited States0.7916666666666666
                                                                                                                                                              RT_DIALOG0x992000x100dataEnglishUnited States0.55859375
                                                                                                                                                              RT_DIALOG0x993000x11cdataEnglishUnited States0.6408450704225352
                                                                                                                                                              RT_DIALOG0x994200x60dataEnglishUnited States0.7916666666666666
                                                                                                                                                              RT_DIALOG0x994800xf8dataEnglishUnited States0.532258064516129
                                                                                                                                                              RT_DIALOG0x995780x114dataEnglishUnited States0.6376811594202898
                                                                                                                                                              RT_DIALOG0x996900x58dataEnglishUnited States0.7840909090909091
                                                                                                                                                              RT_DIALOG0x996e80xecdataEnglishUnited States0.5042372881355932
                                                                                                                                                              RT_DIALOG0x997d80x108dataEnglishUnited States0.6212121212121212
                                                                                                                                                              RT_DIALOG0x998e00x4cdataEnglishUnited States0.75
                                                                                                                                                              RT_DIALOG0x999300xecdataEnglishUnited States0.5042372881355932
                                                                                                                                                              RT_DIALOG0x99a200x108dataEnglishUnited States0.6136363636363636
                                                                                                                                                              RT_DIALOG0x99b280x4cdataEnglishUnited States0.75
                                                                                                                                                              RT_DIALOG0x99b780xf0dataEnglishUnited States0.5125
                                                                                                                                                              RT_DIALOG0x99c680x10cdataEnglishUnited States0.6343283582089553
                                                                                                                                                              RT_DIALOG0x99d780x50dataEnglishUnited States0.7625
                                                                                                                                                              RT_GROUP_ICON0x99dc80x92dataEnglishUnited States0.636986301369863
                                                                                                                                                              RT_VERSION0x99e600x604dataArabicSaudi Arabia0.4707792207792208
                                                                                                                                                              RT_VERSION0x9a4680x604dataBulgarianBulgaria0.462987012987013
                                                                                                                                                              RT_VERSION0x9aa700x61cdataCatalanSpain0.45460358056265987
                                                                                                                                                              RT_VERSION0x9b0900x5e4dataChineseTaiwan0.473474801061008
                                                                                                                                                              RT_VERSION0x9b6780x61cdataCzechCzech Republic0.45460358056265987
                                                                                                                                                              RT_VERSION0x9bc980x614dataDanishDenmark0.45437017994858614
                                                                                                                                                              RT_VERSION0x9c2b00x614dataGermanGermany0.455012853470437
                                                                                                                                                              RT_VERSION0x9c8c80x604dataGreekGreece0.4688311688311688
                                                                                                                                                              RT_VERSION0x9ced00x5ecdataEnglishUnited States0.46437994722955145
                                                                                                                                                              RT_VERSION0x9d4c00x60cdataSpanishSpain0.45671834625323
                                                                                                                                                              RT_VERSION0x9dad00x5f4dataFinnishFinland0.463254593175853
                                                                                                                                                              RT_VERSION0x9e0c80x614dataFrenchFrance0.4537275064267352
                                                                                                                                                              RT_VERSION0x9e6e00x5f0SysEx File - PassportHebrewIsrael0.47039473684210525
                                                                                                                                                              RT_VERSION0x9ecd00x60cdataHungarianHungary0.46382428940568476
                                                                                                                                                              RT_VERSION0x9f2e00x614dataItalianItaly0.45437017994858614
                                                                                                                                                              RT_VERSION0x9f8f80x5dcdataJapaneseJapan0.48933333333333334
                                                                                                                                                              RT_VERSION0x9fed80x5dcdataKoreanNorth Korea0.4713333333333333
                                                                                                                                                              RT_VERSION0x9fed80x5dcdataKoreanSouth Korea0.4713333333333333
                                                                                                                                                              RT_VERSION0xa04b80x604dataDutchNetherlands0.4636363636363636
                                                                                                                                                              RT_VERSION0xa0ac00x614dataNorwegianNorway0.45437017994858614
                                                                                                                                                              RT_VERSION0xa10d80x624dataPolishPoland0.45229007633587787
                                                                                                                                                              RT_VERSION0xa17000x60cdataPortugueseBrazil0.45801033591731266
                                                                                                                                                              RT_VERSION0xa1d100x5fcdataRomanianRomania0.45822454308093996
                                                                                                                                                              RT_VERSION0xa23100x5fcdataRussianRussia0.46736292428198434
                                                                                                                                                              RT_VERSION0xa29100x634dataCroatianCroatia0.45654911838790935
                                                                                                                                                              RT_VERSION0xa2f480x630dataSlovakSlovakia0.45391414141414144
                                                                                                                                                              RT_VERSION0xa35780x5fcdataSwedishSweden0.45822454308093996
                                                                                                                                                              RT_VERSION0xa3b780x62cdataThaiThailand0.4727848101265823
                                                                                                                                                              RT_VERSION0xa41a80x5f4dataTurkishTurkey0.4658792650918635
                                                                                                                                                              RT_VERSION0xa47a00x5ecdataUrduPakistan0.46899736147757254
                                                                                                                                                              RT_VERSION0xa47a00x5ecdataUrduIndia0.46899736147757254
                                                                                                                                                              RT_VERSION0xa4d900x5ecdataIndonesianIndonesia0.4630606860158311
                                                                                                                                                              RT_VERSION0xa53800x604dataUkrainianUkrain0.4668831168831169
                                                                                                                                                              RT_VERSION0xa59880x5fcdataBelarusianBelarus0.46344647519582244
                                                                                                                                                              RT_VERSION0xa5f880x62cdataSlovenianSlovenia0.45126582278481014
                                                                                                                                                              RT_VERSION0xa65b80x61cdataEstonianEstonia0.4648337595907928
                                                                                                                                                              RT_VERSION0xa6bd80x604dataLatvianLativa0.4616883116883117
                                                                                                                                                              RT_VERSION0xa71e00x600TTComp archive data, binary, 4K dictionaryLithuanianLithuania0.46484375
                                                                                                                                                              RT_VERSION0xa77e00x5ecdataFarsiIran0.4683377308707124
                                                                                                                                                              RT_VERSION0xa77e00x5ecdataFarsiAfganistan0.4683377308707124
                                                                                                                                                              RT_VERSION0xa77e00x5ecdataFarsiTajikistan0.4683377308707124
                                                                                                                                                              RT_VERSION0xa77e00x5ecdataFarsiUzbekistan0.4683377308707124
                                                                                                                                                              RT_VERSION0xa7dd00x5fcdataVietnameseVietnam0.46344647519582244
                                                                                                                                                              RT_VERSION0xa83d00x5ecdataHindiIndia0.46899736147757254
                                                                                                                                                              RT_VERSION0xa89c00x5fcdataMalayMalaysia0.4614882506527415
                                                                                                                                                              RT_VERSION0xa8fc00x604dataBengaliIndia0.4844155844155844
                                                                                                                                                              RT_VERSION0xa95c80x5dcdataChineseChina0.47333333333333333
                                                                                                                                                              RT_VERSION0xa9ba80x614dataPortuguesePortugal0.45629820051413883
                                                                                                                                                              RT_VERSION0xaa1c00x624dataSerbianItaly0.4548346055979644
                                                                                                                                                              RT_MANIFEST0xaa7e80x3fcXML 1.0 document, ASCII text, with very long lines (1020), with no line terminatorsEnglishUnited States0.5107843137254902

                                                                                                                                                              Imports

                                                                                                                                                              DLLImport
                                                                                                                                                              KERNEL32.dllExitProcess, SetFileAttributesW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, SetCurrentDirectoryW, GetFileAttributesW, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, CopyFileW, MoveFileW, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, lstrcmpW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalUnlock, GetDiskFreeSpaceW, GlobalAlloc, DeleteFileW, FindFirstFileW, FindNextFileW, FindClose, SetFilePointer, ReadFile, MulDiv, lstrlenA, WideCharToMultiByte, MultiByteToWideChar, WritePrivateProfileStringW, FreeLibrary, GetPrivateProfileStringW, GetModuleHandleW, LoadLibraryExW
                                                                                                                                                              USER32.dllGetWindowRect, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, ScreenToClient, EnableMenuItem, GetDlgItem, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, SystemParametersInfoW, EndDialog, RegisterClassW, DialogBoxParamW, CreateWindowExW, GetClassInfoW, DestroyWindow, CharNextW, ExitWindowsEx, SetWindowTextW, LoadImageW, SetTimer, ShowWindow, PostQuitMessage, wsprintfW, SetWindowLongW, FindWindowExW, IsWindow, CreatePopupMenu, AppendMenuW, GetSystemMetrics, DrawTextW, EndPaint, CreateDialogParamW, SendMessageTimeoutW, SetForegroundWindow
                                                                                                                                                              GDI32.dllSelectObject, SetTextColor, SetBkMode, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, GetDeviceCaps, SetBkColor
                                                                                                                                                              SHELL32.dllShellExecuteExW, SHGetPathFromIDListW, SHGetSpecialFolderLocation, SHGetFileInfoW, SHFileOperationW, SHBrowseForFolderW
                                                                                                                                                              ADVAPI32.dllAdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
                                                                                                                                                              COMCTL32.dllImageList_Create, ImageList_AddMasked, ImageList_Destroy
                                                                                                                                                              ole32.dllOleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

                                                                                                                                                              Possible Origin

                                                                                                                                                              Language of compilation systemCountry where language is spokenMap
                                                                                                                                                              EnglishUnited States
                                                                                                                                                              ArabicSaudi Arabia
                                                                                                                                                              BulgarianBulgaria
                                                                                                                                                              CatalanSpain
                                                                                                                                                              ChineseTaiwan
                                                                                                                                                              CzechCzech Republic
                                                                                                                                                              DanishDenmark
                                                                                                                                                              GermanGermany
                                                                                                                                                              GreekGreece
                                                                                                                                                              FinnishFinland
                                                                                                                                                              FrenchFrance
                                                                                                                                                              HebrewIsrael
                                                                                                                                                              HungarianHungary
                                                                                                                                                              ItalianItaly
                                                                                                                                                              JapaneseJapan
                                                                                                                                                              KoreanNorth Korea
                                                                                                                                                              KoreanSouth Korea
                                                                                                                                                              DutchNetherlands
                                                                                                                                                              NorwegianNorway
                                                                                                                                                              PolishPoland
                                                                                                                                                              PortugueseBrazil
                                                                                                                                                              RomanianRomania
                                                                                                                                                              RussianRussia
                                                                                                                                                              CroatianCroatia
                                                                                                                                                              SlovakSlovakia
                                                                                                                                                              SwedishSweden
                                                                                                                                                              ThaiThailand
                                                                                                                                                              TurkishTurkey
                                                                                                                                                              UrduPakistan
                                                                                                                                                              UrduIndia
                                                                                                                                                              IndonesianIndonesia
                                                                                                                                                              UkrainianUkrain
                                                                                                                                                              BelarusianBelarus
                                                                                                                                                              SlovenianSlovenia
                                                                                                                                                              EstonianEstonia
                                                                                                                                                              LatvianLativa
                                                                                                                                                              LithuanianLithuania
                                                                                                                                                              FarsiIran
                                                                                                                                                              FarsiAfganistan
                                                                                                                                                              FarsiTajikistan
                                                                                                                                                              FarsiUzbekistan
                                                                                                                                                              VietnameseVietnam
                                                                                                                                                              MalayMalaysia
                                                                                                                                                              ChineseChina
                                                                                                                                                              PortuguesePortugal

                                                                                                                                                              Network Behavior

                                                                                                                                                              ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

                                                                                                                                                              Statistics

                                                                                                                                                              CPU Usage

                                                                                                                                                              Click to jump to process

                                                                                                                                                              Memory Usage

                                                                                                                                                              Click to jump to process

                                                                                                                                                              High Level Behavior Distribution

                                                                                                                                                              Click to dive into process behavior distribution

                                                                                                                                                              Behavior

                                                                                                                                                              Click to jump to process

                                                                                                                                                              System Behavior

                                                                                                                                                              General

                                                                                                                                                              Target ID:0
                                                                                                                                                              Start time:11:14:52
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Users\user\Desktop\file.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:"C:\Users\user\Desktop\file.exe"
                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                              File size:6'116'304 bytes
                                                                                                                                                              MD5 hash:60FEB08011DB31607CEE2A5BC1F2206F
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:2
                                                                                                                                                              Start time:11:14:54
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                              Imagebase:0x7ff7e52b0000
                                                                                                                                                              File size:55'320 bytes
                                                                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:high
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:3
                                                                                                                                                              Start time:11:14:56
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\ajF04F.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:"C:\Users\user\AppData\Local\Temp\ajF04F.exe" /relaunch=8 /was_elevated=1 /tagdata
                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                              File size:6'116'200 bytes
                                                                                                                                                              MD5 hash:ACB51434FD82EB460B052F05950B8DCA
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:4
                                                                                                                                                              Start time:11:15:02
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:AVGBrowserUpdateSetup.exe /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-GB&brand=9249&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dchrome --import-cookies --auto-launch-chrome"
                                                                                                                                                              Imagebase:0xb10000
                                                                                                                                                              File size:1'688'480 bytes
                                                                                                                                                              MD5 hash:9750EA6C750629D2CA971AB1C074DC9D
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: PlugXStrings, Description: PlugX Identifying Strings, Source: 00000004.00000003.2119106262.0000000003483000.00000004.00000020.00020000.00000000.sdmp, Author: Seth Hardy
                                                                                                                                                              • Rule: PlugXStrings, Description: PlugX Identifying Strings, Source: 00000004.00000003.2112481989.0000000002C6C000.00000004.00000020.00020000.00000000.sdmp, Author: Seth Hardy
                                                                                                                                                              • Rule: PlugXStrings, Description: PlugX Identifying Strings, Source: 00000004.00000003.2116230812.0000000003E11000.00000004.00000020.00020000.00000000.sdmp, Author: Seth Hardy
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:5
                                                                                                                                                              Start time:11:15:05
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:"C:\Program Files (x86)\GUMA6B.tmp\AVGBrowserUpdate.exe" /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-GB&brand=9249&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dchrome --import-cookies --auto-launch-chrome"
                                                                                                                                                              Imagebase:0xa60000
                                                                                                                                                              File size:209'736 bytes
                                                                                                                                                              MD5 hash:CBCDF56C8A2788ED761AD3178E2D6E9C
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:6
                                                                                                                                                              Start time:11:15:09
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regsvc
                                                                                                                                                              Imagebase:0x70000
                                                                                                                                                              File size:209'736 bytes
                                                                                                                                                              MD5 hash:CBCDF56C8A2788ED761AD3178E2D6E9C
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:8
                                                                                                                                                              Start time:11:15:10
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regserver
                                                                                                                                                              Imagebase:0x70000
                                                                                                                                                              File size:209'736 bytes
                                                                                                                                                              MD5 hash:CBCDF56C8A2788ED761AD3178E2D6E9C
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:9
                                                                                                                                                              Start time:11:15:10
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"
                                                                                                                                                              Imagebase:0x7ff677b10000
                                                                                                                                                              File size:438'608 bytes
                                                                                                                                                              MD5 hash:2A3AD7362E6C8808FBB4D4CCABA4ED4A
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Antivirus matches:
                                                                                                                                                              • Detection: 0%, ReversingLabs
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:10
                                                                                                                                                              Start time:11:15:10
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"
                                                                                                                                                              Imagebase:0x7ff677b10000
                                                                                                                                                              File size:438'608 bytes
                                                                                                                                                              MD5 hash:2A3AD7362E6C8808FBB4D4CCABA4ED4A
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:11
                                                                                                                                                              Start time:11:15:11
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /c
                                                                                                                                                              Imagebase:0x70000
                                                                                                                                                              File size:209'736 bytes
                                                                                                                                                              MD5 hash:CBCDF56C8A2788ED761AD3178E2D6E9C
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:12
                                                                                                                                                              Start time:11:15:11
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"
                                                                                                                                                              Imagebase:0x7ff677b10000
                                                                                                                                                              File size:438'608 bytes
                                                                                                                                                              MD5 hash:2A3AD7362E6C8808FBB4D4CCABA4ED4A
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:13
                                                                                                                                                              Start time:11:15:11
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ua /installsource scheduler
                                                                                                                                                              Imagebase:0x70000
                                                                                                                                                              File size:209'736 bytes
                                                                                                                                                              MD5 hash:CBCDF56C8A2788ED761AD3178E2D6E9C
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:14
                                                                                                                                                              Start time:11:15:11
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /registermsihelper
                                                                                                                                                              Imagebase:0x70000
                                                                                                                                                              File size:209'736 bytes
                                                                                                                                                              MD5 hash:CBCDF56C8A2788ED761AD3178E2D6E9C
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:15
                                                                                                                                                              Start time:11:15:12
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Windows\System32\msiexec.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:C:\Windows\system32\msiexec.exe /V
                                                                                                                                                              Imagebase:0x7ff77aad0000
                                                                                                                                                              File size:69'632 bytes
                                                                                                                                                              MD5 hash:E5DA170027542E25EDE42FC54C929077
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:high
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:16
                                                                                                                                                              Start time:11:15:14
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTY5My42IiBzaGVsbF92ZXJzaW9uPSIxLjguMTY5My42IiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0iezc2MzdDRkNCLUUwOEQtNDNENC1CMUY3LUMyNERBQjEzQkI4MH0iIGNlcnRfZXhwX2RhdGU9IjIwMjUwOTE3IiB1c2VyaWQ9IntFMUJBQjY4OC1CMDJGLTQ3NDktOUY4OC0zRTFCNEU3REE5OTR9IiB1c2VyaWRfZGF0ZT0iMjAyNDA2MDMiIG1hY2hpbmVpZD0iezAwMDBGOEI1LUM3REUtQTQ4Qy1EMDU4LTA3RTI0NTVCOUE1Qn0iIG1hY2hpbmVpZF9kYXRlPSIyMDI0MDYwMyIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9InsyNTJFNzAzQS1GNkRGLTRBQjYtOTE2MS00NEZENUYwNjYwMER9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDUuMjAwNiIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuOC4xNjkzLjYiIGxhbmc9ImVuLUdCIiBicmFuZD0iOTI0OSIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iNjA2MyIvPjwvYXBwPjwvcmVxdWVzdD4
                                                                                                                                                              Imagebase:0x70000
                                                                                                                                                              File size:209'736 bytes
                                                                                                                                                              MD5 hash:CBCDF56C8A2788ED761AD3178E2D6E9C
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:17
                                                                                                                                                              Start time:11:15:14
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /handoff "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-GB&brand=9249&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dchrome --import-cookies --auto-launch-chrome" /installsource otherinstallcmd /sessionid "{7637CFCB-E08D-43D4-B1F7-C24DAB13BB80}" /silent
                                                                                                                                                              Imagebase:0x70000
                                                                                                                                                              File size:209'736 bytes
                                                                                                                                                              MD5 hash:CBCDF56C8A2788ED761AD3178E2D6E9C
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:18
                                                                                                                                                              Start time:11:15:14
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc
                                                                                                                                                              Imagebase:0x70000
                                                                                                                                                              File size:209'736 bytes
                                                                                                                                                              MD5 hash:CBCDF56C8A2788ED761AD3178E2D6E9C
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:19
                                                                                                                                                              Start time:11:15:19
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /uninstall
                                                                                                                                                              Imagebase:0x70000
                                                                                                                                                              File size:209'736 bytes
                                                                                                                                                              MD5 hash:CBCDF56C8A2788ED761AD3178E2D6E9C
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:20
                                                                                                                                                              Start time:11:15:40
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\AVGBrowserInstaller.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\AVGBrowserInstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=chrome --import-cookies --auto-launch-chrome --system-level
                                                                                                                                                              Imagebase:0x7ff73bed0000
                                                                                                                                                              File size:117'845'816 bytes
                                                                                                                                                              MD5 hash:371F796FCFD9D0BA16C7DA57487323A0
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:22
                                                                                                                                                              Start time:11:15:39
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                                                              Imagebase:0x7ff7e52b0000
                                                                                                                                                              File size:55'320 bytes
                                                                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:high
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:23
                                                                                                                                                              Start time:11:15:45
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe" --install-archive="C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\SECURE.PACKED.7Z" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=chrome --import-cookies --auto-launch-chrome --system-level
                                                                                                                                                              Imagebase:0x7ff601580000
                                                                                                                                                              File size:3'498'000 bytes
                                                                                                                                                              MD5 hash:0DFA65976DA7822DB99118ABF2A50CC9
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:24
                                                                                                                                                              Start time:11:15:46
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files (x86)\AVG\Browser\Update\Install\{4677E0B5-6B78-429F-9D3A-DC313E93F94B}\CR_80683.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=124.0.25069.209 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff60185a3f0,0x7ff60185a3fc,0x7ff60185a408
                                                                                                                                                              Imagebase:0x7ff601580000
                                                                                                                                                              File size:3'498'000 bytes
                                                                                                                                                              MD5 hash:0DFA65976DA7822DB99118ABF2A50CC9
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:26
                                                                                                                                                              Start time:11:16:18
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=heartbeat --hourly
                                                                                                                                                              Imagebase:0x7ff690ef0000
                                                                                                                                                              File size:3'146'744 bytes
                                                                                                                                                              MD5 hash:7BD74C28BFADFF16A053A3B5E2B51195
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:27
                                                                                                                                                              Start time:11:16:19
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=heartbeat --logon
                                                                                                                                                              Imagebase:0x7ff690ef0000
                                                                                                                                                              File size:3'146'744 bytes
                                                                                                                                                              MD5 hash:7BD74C28BFADFF16A053A3B5E2B51195
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:28
                                                                                                                                                              Start time:11:16:19
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --heartbeat --hourly
                                                                                                                                                              Imagebase:0x7ff690ef0000
                                                                                                                                                              File size:3'146'744 bytes
                                                                                                                                                              MD5 hash:7BD74C28BFADFF16A053A3B5E2B51195
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:29
                                                                                                                                                              Start time:11:16:19
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --heartbeat --logon
                                                                                                                                                              Imagebase:0x7ff690ef0000
                                                                                                                                                              File size:3'146'744 bytes
                                                                                                                                                              MD5 hash:7BD74C28BFADFF16A053A3B5E2B51195
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:30
                                                                                                                                                              Start time:11:16:19
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\Temp\\Heartbeat8108_647370180 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\Temp\\Heartbeat8108_647370180\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=124.0.25069.209 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8a7b0dc40,0x7ff8a7b0dc4c,0x7ff8a7b0dc58
                                                                                                                                                              Imagebase:0x7ff690ef0000
                                                                                                                                                              File size:3'146'744 bytes
                                                                                                                                                              MD5 hash:7BD74C28BFADFF16A053A3B5E2B51195
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:31
                                                                                                                                                              Start time:11:16:19
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\Temp\\Heartbeat8128_116327840 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\Temp\\Heartbeat8128_116327840\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=124.0.25069.209 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8a7b0dc40,0x7ff8a7b0dc4c,0x7ff8a7b0dc58
                                                                                                                                                              Imagebase:0x7ff690ef0000
                                                                                                                                                              File size:3'146'744 bytes
                                                                                                                                                              MD5 hash:7BD74C28BFADFF16A053A3B5E2B51195
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:32
                                                                                                                                                              Start time:11:16:20
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"
                                                                                                                                                              Imagebase:0x770000
                                                                                                                                                              File size:152'880 bytes
                                                                                                                                                              MD5 hash:F73E60370EFE16A6D985E564275612DA
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Antivirus matches:
                                                                                                                                                              • Detection: 0%, ReversingLabs
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:33
                                                                                                                                                              Start time:11:16:20
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"
                                                                                                                                                              Imagebase:0x7ff60bfd0000
                                                                                                                                                              File size:174'120 bytes
                                                                                                                                                              MD5 hash:DEEF1E7382D212CD403431727BE417A5
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Antivirus matches:
                                                                                                                                                              • Detection: 0%, ReversingLabs
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:34
                                                                                                                                                              Start time:11:16:25
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2124,i,2166630059599507292,14770330184015614422,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:2
                                                                                                                                                              Imagebase:0x7ff690ef0000
                                                                                                                                                              File size:3'146'744 bytes
                                                                                                                                                              MD5 hash:7BD74C28BFADFF16A053A3B5E2B51195
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:35
                                                                                                                                                              Start time:11:16:24
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2028,i,14563547802735666349,826896251076988020,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
                                                                                                                                                              Imagebase:0x7ff690ef0000
                                                                                                                                                              File size:3'146'744 bytes
                                                                                                                                                              MD5 hash:7BD74C28BFADFF16A053A3B5E2B51195
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:36
                                                                                                                                                              Start time:11:16:24
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exe"
                                                                                                                                                              Imagebase:0x7ff768610000
                                                                                                                                                              File size:1'745'448 bytes
                                                                                                                                                              MD5 hash:A4FA49989838F0B3038A008870561894
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:37
                                                                                                                                                              Start time:11:16:24
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
                                                                                                                                                              Imagebase:0x7ff7e52b0000
                                                                                                                                                              File size:55'320 bytes
                                                                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:high
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:38
                                                                                                                                                              Start time:11:16:25
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:AVGBrowser.exe --heartbeat --install --create-profile
                                                                                                                                                              Imagebase:0x7ff690ef0000
                                                                                                                                                              File size:3'146'744 bytes
                                                                                                                                                              MD5 hash:7BD74C28BFADFF16A053A3B5E2B51195
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:39
                                                                                                                                                              Start time:11:16:25
                                                                                                                                                              Start date:03/06/2024
                                                                                                                                                              Path:C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exe"
                                                                                                                                                              Imagebase:0x7ff768610000
                                                                                                                                                              File size:1'745'448 bytes
                                                                                                                                                              MD5 hash:A4FA49989838F0B3038A008870561894
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              Disassembly

                                                                                                                                                              Reset < >

                                                                                                                                                                Execution Graph

                                                                                                                                                                Execution Coverage:8.5%
                                                                                                                                                                Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                Signature Coverage:6.4%
                                                                                                                                                                Total number of Nodes:2000
                                                                                                                                                                Total number of Limit Nodes:35
                                                                                                                                                                execution_graph 13194 b15db0 13197 b15dfe 13194->13197 13198 b15dbb 13197->13198 13199 b15e07 13197->13199 13199->13198 13206 b16223 13199->13206 13201 b15e42 13202 b16223 CallUnexpected 53 API calls 13201->13202 13203 b15e4d 13202->13203 13219 b18f74 13203->13219 13225 b16231 13206->13225 13208 b16228 13208->13201 13239 b1ec24 13208->13239 13212 b1904a IsProcessorFeaturePresent 13216 b19056 13212->13216 13213 b19069 13214 b188a7 CallUnexpected 23 API calls 13213->13214 13218 b19073 13214->13218 13215 b19040 13215->13212 13215->13213 13217 b1bcc4 CallUnexpected 8 API calls 13216->13217 13217->13213 13220 b18f80 __FrameHandler3::FrameUnwindToState 13219->13220 13221 b1b9b0 _unexpected 43 API calls 13220->13221 13223 b18f85 13221->13223 13222 b19030 CallUnexpected 43 API calls 13224 b18faf 13222->13224 13223->13222 13226 b1623a 13225->13226 13227 b1623d GetLastError 13225->13227 13226->13208 13269 b1650c 13227->13269 13229 b162b7 SetLastError 13229->13208 13231 b16547 ___vcrt_FlsSetValue 6 API calls 13232 b1626b CallUnexpected 13231->13232 13233 b16293 13232->13233 13234 b16547 ___vcrt_FlsSetValue 6 API calls 13232->13234 13238 b16271 13232->13238 13235 b16547 ___vcrt_FlsSetValue 6 API calls 13233->13235 13236 b162a7 13233->13236 13234->13233 13235->13236 13237 b18fb0 ___vcrt_freefls@4 14 API calls 13236->13237 13237->13238 13238->13229 13274 b1eb56 13239->13274 13242 b1ec69 13243 b1ec75 __FrameHandler3::FrameUnwindToState 13242->13243 13244 b1bb01 __dosmaperr 14 API calls 13243->13244 13248 b1eca2 CallUnexpected 13243->13248 13251 b1ec9c CallUnexpected 13243->13251 13244->13251 13245 b1ece9 13247 b1bfa1 __dosmaperr 14 API calls 13245->13247 13246 b1ecd3 13246->13215 13249 b1ecee 13247->13249 13250 b1ed15 13248->13250 13285 b1d5d1 EnterCriticalSection 13248->13285 13252 b1bec0 ___std_exception_copy 43 API calls 13249->13252 13255 b1ee48 13250->13255 13258 b1ed57 13250->13258 13266 b1ed86 13250->13266 13251->13245 13251->13246 13251->13248 13252->13246 13259 b1ee53 13255->13259 13290 b1d619 LeaveCriticalSection 13255->13290 13257 b188a7 CallUnexpected 23 API calls 13260 b1ee5b 13257->13260 13262 b1b9b0 _unexpected 43 API calls 13258->13262 13258->13266 13259->13257 13263 b1ed7b 13262->13263 13265 b1b9b0 _unexpected 43 API calls 13263->13265 13264 b1b9b0 _unexpected 43 API calls 13267 b1eddb 13264->13267 13265->13266 13286 b1edf5 13266->13286 13267->13246 13268 b1b9b0 _unexpected 43 API calls 13267->13268 13268->13246 13270 b1644d ___vcrt_FlsFree 5 API calls 13269->13270 13271 b16526 13270->13271 13272 b1653e TlsGetValue 13271->13272 13273 b16252 13271->13273 13272->13273 13273->13229 13273->13231 13273->13238 13275 b1eb62 __FrameHandler3::FrameUnwindToState 13274->13275 13280 b1d5d1 EnterCriticalSection 13275->13280 13277 b1eb70 13281 b1ebae 13277->13281 13280->13277 13284 b1d619 LeaveCriticalSection 13281->13284 13283 b19035 13283->13215 13283->13242 13284->13283 13285->13250 13287 b1edcc 13286->13287 13288 b1edfb 13286->13288 13287->13246 13287->13264 13287->13267 13291 b1d619 LeaveCriticalSection 13288->13291 13290->13259 13291->13287 13144 b12c26 13145 b12c37 13144->13145 13146 b12c40 13145->13146 13149 b12c4a 13145->13149 13147 b12d29 16 API calls 13146->13147 13148 b12c48 13147->13148 13149->13148 13151 b12cf1 13149->13151 13152 b12d14 13151->13152 13153 b12d05 13151->13153 13154 b12da3 RaiseException 13152->13154 13156 b12d18 13152->13156 13153->13152 13158 b1131f 13153->13158 13155 b12d28 13154->13155 13156->13148 13159 b1132a 13158->13159 13160 b11365 13158->13160 13159->13160 13162 b11168 13159->13162 13160->13152 13163 b1117b 13162->13163 13164 b11172 13162->13164 13163->13164 13165 b1118b RtlReAllocateHeap 13163->13165 13164->13160 13165->13164 10969 b15095 10970 b150a1 __FrameHandler3::FrameUnwindToState 10969->10970 10997 b15291 10970->10997 10972 b150a8 10973 b151fb 10972->10973 10981 b150d2 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock CallUnexpected 10972->10981 11055 b1557c IsProcessorFeaturePresent 10973->11055 10975 b15202 11034 b188e3 10975->11034 10980 b150f1 10981->10980 10982 b15172 10981->10982 11037 b188bd 10981->11037 11008 b15697 10982->11008 10992 b15198 10993 b151a1 10992->10993 11046 b18898 10992->11046 11049 b15402 10993->11049 10998 b1529a 10997->10998 11062 b15825 IsProcessorFeaturePresent 10998->11062 11002 b152ab 11007 b152af 11002->11007 11072 b18ed3 11002->11072 11005 b152c6 11005->10972 11007->10972 11391 b15f10 11008->11391 11010 b156aa GetStartupInfoW 11011 b15178 11010->11011 11012 b1852a 11011->11012 11393 b1d021 11012->11393 11014 b15180 11017 b124ad GetModuleHandleW GetProcAddress 11014->11017 11016 b18533 11016->11014 11399 b1d355 11016->11399 11018 b124d5 CoInitializeEx 11017->11018 11019 b124ce 11017->11019 11020 b124e7 11018->11020 11026 b124f2 11018->11026 11019->11018 11764 b113a0 11020->11764 11025 b12502 11769 b11887 11025->11769 11853 b123f7 11026->11853 12921 b1870e 11034->12921 11038 b188d3 _unexpected 11037->11038 11039 b18f74 __FrameHandler3::FrameUnwindToState 11037->11039 11038->10982 11040 b1b9b0 _unexpected 43 API calls 11039->11040 11043 b18f85 11040->11043 11041 b19030 CallUnexpected 43 API calls 11042 b18faf 11041->11042 11043->11041 11044 b156cd GetModuleHandleW 11045 b15194 11044->11045 11045->10975 11045->10992 11047 b1870e CallUnexpected 23 API calls 11046->11047 11048 b188a3 11047->11048 11048->10993 11050 b1540e 11049->11050 11051 b151a9 11050->11051 12996 b18ee5 11050->12996 11051->10980 11053 b1541c 11054 b15cfd ___scrt_uninitialize_crt 7 API calls 11053->11054 11054->11051 11056 b15592 CallUnexpected 11055->11056 11057 b1563d IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 11056->11057 11058 b15688 CallUnexpected 11057->11058 11058->10975 11059 b188a7 11060 b1870e CallUnexpected 23 API calls 11059->11060 11061 b15210 11060->11061 11063 b152a6 11062->11063 11064 b15cde 11063->11064 11081 b16311 11064->11081 11067 b15ce7 11067->11002 11069 b15cef 11070 b15cfa 11069->11070 11095 b1634d 11069->11095 11070->11002 11137 b1ea25 11072->11137 11075 b15cfd 11076 b15d10 11075->11076 11077 b15d06 11075->11077 11076->11007 11078 b162f6 ___vcrt_uninitialize_ptd 6 API calls 11077->11078 11079 b15d0b 11078->11079 11080 b1634d ___vcrt_uninitialize_locks DeleteCriticalSection 11079->11080 11080->11076 11082 b1631a 11081->11082 11084 b16343 11082->11084 11085 b15ce3 11082->11085 11099 b16585 11082->11099 11086 b1634d ___vcrt_uninitialize_locks DeleteCriticalSection 11084->11086 11085->11067 11087 b162c3 11085->11087 11086->11085 11118 b16496 11087->11118 11092 b162f3 11092->11069 11094 b162d8 11094->11069 11096 b16377 11095->11096 11097 b16358 11095->11097 11096->11067 11098 b16362 DeleteCriticalSection 11097->11098 11098->11096 11098->11098 11104 b1644d 11099->11104 11102 b165bd InitializeCriticalSectionAndSpinCount 11103 b165a8 11102->11103 11103->11082 11105 b16488 11104->11105 11106 b16465 11104->11106 11105->11102 11105->11103 11106->11105 11110 b163b3 11106->11110 11109 b1647a GetProcAddress 11109->11105 11116 b163bf ___vcrt_FlsFree 11110->11116 11111 b16433 11111->11105 11111->11109 11112 b163d5 LoadLibraryExW 11113 b163f3 GetLastError 11112->11113 11114 b1643a 11112->11114 11113->11116 11114->11111 11115 b16442 FreeLibrary 11114->11115 11115->11111 11116->11111 11116->11112 11117 b16415 LoadLibraryExW 11116->11117 11117->11114 11117->11116 11119 b1644d ___vcrt_FlsFree 5 API calls 11118->11119 11120 b164b0 11119->11120 11121 b164c9 TlsAlloc 11120->11121 11122 b162cd 11120->11122 11122->11094 11123 b16547 11122->11123 11124 b1644d ___vcrt_FlsFree 5 API calls 11123->11124 11125 b16561 11124->11125 11126 b1657c TlsSetValue 11125->11126 11127 b162e6 11125->11127 11126->11127 11127->11092 11128 b162f6 11127->11128 11129 b16300 11128->11129 11130 b16306 11128->11130 11132 b164d1 11129->11132 11130->11094 11133 b1644d ___vcrt_FlsFree 5 API calls 11132->11133 11134 b164eb 11133->11134 11135 b16503 TlsFree 11134->11135 11136 b164f7 11134->11136 11135->11136 11136->11130 11138 b1ea35 11137->11138 11139 b152b8 11137->11139 11138->11139 11141 b1da6c 11138->11141 11139->11005 11139->11075 11142 b1da78 __FrameHandler3::FrameUnwindToState 11141->11142 11153 b1d5d1 EnterCriticalSection 11142->11153 11144 b1da7f 11154 b1d711 11144->11154 11147 b1da9d 11178 b1dac3 11147->11178 11153->11144 11155 b1d71d __FrameHandler3::FrameUnwindToState 11154->11155 11156 b1d747 11155->11156 11157 b1d726 11155->11157 11181 b1d5d1 EnterCriticalSection 11156->11181 11189 b1bfa1 11157->11189 11163 b1d753 11166 b1d77f 11163->11166 11182 b1d661 11163->11182 11164 b1d735 11164->11147 11167 b1d906 GetStartupInfoW 11164->11167 11195 b1d7a6 11166->11195 11168 b1d923 11167->11168 11170 b1d9b7 11167->11170 11169 b1d711 44 API calls 11168->11169 11168->11170 11171 b1d94b 11169->11171 11173 b1d9bc 11170->11173 11171->11170 11172 b1d97b GetFileType 11171->11172 11172->11171 11175 b1d9c3 11173->11175 11174 b1da06 GetStdHandle 11174->11175 11175->11174 11176 b1da68 11175->11176 11177 b1da19 GetFileType 11175->11177 11176->11147 11177->11175 11390 b1d619 LeaveCriticalSection 11178->11390 11180 b1daae 11180->11138 11181->11163 11198 b1bfb4 11182->11198 11184 b1d673 11188 b1d680 11184->11188 11205 b1e86f 11184->11205 11210 b1c011 11188->11210 11243 b1bb01 GetLastError 11189->11243 11191 b1bfa6 11192 b1bec0 11191->11192 11307 b1be0c 11192->11307 11389 b1d619 LeaveCriticalSection 11195->11389 11197 b1d7ad 11197->11164 11203 b1bfc1 _unexpected 11198->11203 11199 b1c001 11202 b1bfa1 __dosmaperr 13 API calls 11199->11202 11200 b1bfec RtlAllocateHeap 11201 b1bfff 11200->11201 11200->11203 11201->11184 11202->11201 11203->11199 11203->11200 11216 b1eacd 11203->11216 11229 b1e68e 11205->11229 11207 b1e88b 11208 b1e8a9 InitializeCriticalSectionAndSpinCount 11207->11208 11209 b1e894 11207->11209 11208->11209 11209->11184 11211 b1c046 11210->11211 11212 b1c01c RtlFreeHeap 11210->11212 11211->11163 11212->11211 11213 b1c031 GetLastError 11212->11213 11214 b1c03e __dosmaperr 11213->11214 11215 b1bfa1 __dosmaperr 12 API calls 11214->11215 11215->11211 11219 b1eafa 11216->11219 11220 b1eb06 __FrameHandler3::FrameUnwindToState 11219->11220 11225 b1d5d1 EnterCriticalSection 11220->11225 11222 b1eb11 11226 b1eb4d 11222->11226 11225->11222 11227 b1d619 CallUnexpected LeaveCriticalSection 11226->11227 11228 b1ead8 11227->11228 11228->11203 11230 b1e6bc 11229->11230 11234 b1e6b8 _unexpected 11229->11234 11230->11234 11235 b1e5c3 11230->11235 11233 b1e6d6 GetProcAddress 11233->11234 11234->11207 11236 b1e5d4 ___vcrt_FlsFree 11235->11236 11237 b1e66a 11236->11237 11238 b1e5f2 LoadLibraryExW 11236->11238 11242 b1e640 LoadLibraryExW 11236->11242 11237->11233 11237->11234 11239 b1e671 11238->11239 11240 b1e60d GetLastError 11238->11240 11239->11237 11241 b1e683 FreeLibrary 11239->11241 11240->11236 11241->11237 11242->11236 11242->11239 11244 b1bb17 11243->11244 11249 b1bb1d 11243->11249 11266 b1e7ee 11244->11266 11248 b1bb21 SetLastError 11248->11191 11249->11248 11271 b1e82d 11249->11271 11251 b1bfb4 _unexpected 12 API calls 11252 b1bb4e 11251->11252 11253 b1bb67 11252->11253 11254 b1bb56 11252->11254 11256 b1e82d _unexpected 6 API calls 11253->11256 11255 b1e82d _unexpected 6 API calls 11254->11255 11257 b1bb64 11255->11257 11258 b1bb73 11256->11258 11263 b1c011 __freea 12 API calls 11257->11263 11259 b1bb77 11258->11259 11260 b1bb8e 11258->11260 11262 b1e82d _unexpected 6 API calls 11259->11262 11276 b1b7de 11260->11276 11262->11257 11263->11248 11265 b1c011 __freea 12 API calls 11265->11248 11267 b1e68e _unexpected 5 API calls 11266->11267 11268 b1e80a 11267->11268 11269 b1e813 11268->11269 11270 b1e825 TlsGetValue 11268->11270 11269->11249 11272 b1e68e _unexpected 5 API calls 11271->11272 11273 b1e849 11272->11273 11274 b1e867 TlsSetValue 11273->11274 11275 b1bb39 11273->11275 11275->11248 11275->11251 11281 b1b672 11276->11281 11282 b1b67e __FrameHandler3::FrameUnwindToState 11281->11282 11295 b1d5d1 EnterCriticalSection 11282->11295 11284 b1b688 11296 b1b6b8 11284->11296 11287 b1b784 11288 b1b790 __FrameHandler3::FrameUnwindToState 11287->11288 11299 b1d5d1 EnterCriticalSection 11288->11299 11290 b1b79a 11300 b1b965 11290->11300 11292 b1b7b2 11304 b1b7d2 11292->11304 11295->11284 11297 b1d619 CallUnexpected LeaveCriticalSection 11296->11297 11298 b1b6a6 11297->11298 11298->11287 11299->11290 11301 b1b99b _unexpected 11300->11301 11302 b1b974 _unexpected 11300->11302 11301->11292 11302->11301 11303 b1e258 _unexpected 14 API calls 11302->11303 11303->11301 11305 b1d619 CallUnexpected LeaveCriticalSection 11304->11305 11306 b1b7c0 11305->11306 11306->11265 11308 b1be1e ___std_exception_copy 11307->11308 11313 b1be43 11308->11313 11310 b1be36 11324 b1a270 11310->11324 11314 b1be53 11313->11314 11315 b1be5a 11313->11315 11330 b1a3e0 GetLastError 11314->11330 11320 b1be68 11315->11320 11334 b1bc9b 11315->11334 11318 b1be8f 11318->11320 11337 b1bed0 IsProcessorFeaturePresent 11318->11337 11320->11310 11321 b1bebf 11322 b1be0c ___std_exception_copy 43 API calls 11321->11322 11323 b1becc 11322->11323 11323->11310 11325 b1a27c 11324->11325 11328 b1a293 11325->11328 11369 b1a430 11325->11369 11327 b1a2a6 11327->11164 11328->11327 11329 b1a430 ___std_exception_copy 43 API calls 11328->11329 11329->11327 11331 b1a3f9 11330->11331 11341 b1bbb2 11331->11341 11335 b1bca6 GetLastError SetLastError 11334->11335 11336 b1bcbf 11334->11336 11335->11318 11336->11318 11338 b1bedc 11337->11338 11363 b1bcc4 11338->11363 11342 b1bbc5 11341->11342 11343 b1bbcb 11341->11343 11345 b1e7ee _unexpected 6 API calls 11342->11345 11344 b1e82d _unexpected 6 API calls 11343->11344 11362 b1a415 SetLastError 11343->11362 11346 b1bbe5 11344->11346 11345->11343 11347 b1bfb4 _unexpected 14 API calls 11346->11347 11346->11362 11348 b1bbf5 11347->11348 11349 b1bc12 11348->11349 11350 b1bbfd 11348->11350 11351 b1e82d _unexpected 6 API calls 11349->11351 11352 b1e82d _unexpected 6 API calls 11350->11352 11353 b1bc1e 11351->11353 11354 b1bc09 11352->11354 11355 b1bc31 11353->11355 11356 b1bc22 11353->11356 11359 b1c011 __freea 14 API calls 11354->11359 11358 b1b7de _unexpected 14 API calls 11355->11358 11357 b1e82d _unexpected 6 API calls 11356->11357 11357->11354 11360 b1bc3c 11358->11360 11359->11362 11361 b1c011 __freea 14 API calls 11360->11361 11361->11362 11362->11315 11364 b1bce0 CallUnexpected 11363->11364 11365 b1bd0c IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 11364->11365 11366 b1bddd CallUnexpected 11365->11366 11367 b15a02 _ValidateLocalCookies 5 API calls 11366->11367 11368 b1bdfb GetCurrentProcess TerminateProcess 11367->11368 11368->11321 11370 b1a47f 11369->11370 11371 b1a43e GetLastError 11369->11371 11370->11328 11372 b1a44d 11371->11372 11373 b1bbb2 ___std_exception_copy 14 API calls 11372->11373 11374 b1a46a SetLastError 11373->11374 11374->11370 11375 b1a486 11374->11375 11378 b19030 11375->11378 11379 b1ec24 CallUnexpected EnterCriticalSection LeaveCriticalSection 11378->11379 11380 b19035 11379->11380 11381 b1ec69 CallUnexpected 42 API calls 11380->11381 11384 b19040 11380->11384 11381->11384 11382 b1904a IsProcessorFeaturePresent 11385 b19056 11382->11385 11383 b188a7 CallUnexpected 23 API calls 11387 b19073 11383->11387 11384->11382 11388 b19069 11384->11388 11386 b1bcc4 CallUnexpected 8 API calls 11385->11386 11386->11388 11388->11383 11389->11197 11390->11180 11392 b15f27 11391->11392 11392->11010 11392->11392 11394 b1d02a 11393->11394 11398 b1d05c 11393->11398 11402 b1ba6b 11394->11402 11398->11016 11761 b1d305 11399->11761 11403 b1ba76 11402->11403 11407 b1ba7c 11402->11407 11404 b1e7ee _unexpected 6 API calls 11403->11404 11404->11407 11405 b1e82d _unexpected 6 API calls 11408 b1ba96 11405->11408 11406 b1ba82 11409 b19030 CallUnexpected 43 API calls 11406->11409 11410 b1ba87 11406->11410 11407->11405 11407->11406 11408->11406 11411 b1bfb4 _unexpected 14 API calls 11408->11411 11412 b1bb00 11409->11412 11427 b1ce2c 11410->11427 11413 b1baa6 11411->11413 11414 b1bac3 11413->11414 11415 b1baae 11413->11415 11416 b1e82d _unexpected 6 API calls 11414->11416 11417 b1e82d _unexpected 6 API calls 11415->11417 11418 b1bacf 11416->11418 11419 b1baba 11417->11419 11420 b1bad3 11418->11420 11421 b1bae2 11418->11421 11422 b1c011 __freea 14 API calls 11419->11422 11423 b1e82d _unexpected 6 API calls 11420->11423 11424 b1b7de _unexpected 14 API calls 11421->11424 11422->11406 11423->11419 11425 b1baed 11424->11425 11426 b1c011 __freea 14 API calls 11425->11426 11426->11410 11450 b1cf81 11427->11450 11432 b1ce6f 11432->11398 11435 b1ce96 11475 b1d07c 11435->11475 11436 b1ce88 11437 b1c011 __freea 14 API calls 11436->11437 11437->11432 11440 b1cece 11441 b1bfa1 __dosmaperr 14 API calls 11440->11441 11443 b1ced3 11441->11443 11442 b1cf15 11445 b1cf5e 11442->11445 11486 b1ca9e 11442->11486 11446 b1c011 __freea 14 API calls 11443->11446 11444 b1cee9 11444->11442 11447 b1c011 __freea 14 API calls 11444->11447 11449 b1c011 __freea 14 API calls 11445->11449 11446->11432 11447->11442 11449->11432 11451 b1cf8d __FrameHandler3::FrameUnwindToState 11450->11451 11459 b1cfa7 11451->11459 11494 b1d5d1 EnterCriticalSection 11451->11494 11453 b1ce56 11461 b1cbac 11453->11461 11454 b19030 CallUnexpected 43 API calls 11458 b1d020 11454->11458 11455 b1cfe3 11495 b1d000 11455->11495 11456 b1cfb7 11456->11455 11460 b1c011 __freea 14 API calls 11456->11460 11459->11453 11459->11454 11460->11455 11499 b1c6ab 11461->11499 11464 b1cbcd GetOEMCP 11466 b1cbf6 11464->11466 11465 b1cbdf 11465->11466 11467 b1cbe4 GetACP 11465->11467 11466->11432 11468 b1dd8c 11466->11468 11467->11466 11469 b1ddca 11468->11469 11473 b1dd9a _unexpected 11468->11473 11470 b1bfa1 __dosmaperr 14 API calls 11469->11470 11472 b1ce80 11470->11472 11471 b1ddb5 RtlAllocateHeap 11471->11472 11471->11473 11472->11435 11472->11436 11473->11469 11473->11471 11474 b1eacd _unexpected 2 API calls 11473->11474 11474->11473 11476 b1cbac 45 API calls 11475->11476 11477 b1d09c 11476->11477 11479 b1d0d9 IsValidCodePage 11477->11479 11483 b1d115 CallUnexpected 11477->11483 11481 b1d0eb 11479->11481 11479->11483 11480 b1cec3 11480->11440 11480->11444 11482 b1d11a GetCPInfo 11481->11482 11484 b1d0f4 CallUnexpected 11481->11484 11482->11483 11482->11484 11654 b15a02 11483->11654 11643 b1cc80 11484->11643 11487 b1caaa __FrameHandler3::FrameUnwindToState 11486->11487 11735 b1d5d1 EnterCriticalSection 11487->11735 11489 b1cab4 11736 b1caeb 11489->11736 11494->11456 11498 b1d619 LeaveCriticalSection 11495->11498 11497 b1d007 11497->11459 11498->11497 11500 b1c6c2 11499->11500 11501 b1c6cb 11499->11501 11500->11464 11500->11465 11501->11500 11507 b1b9b0 GetLastError 11501->11507 11508 b1b9c6 11507->11508 11512 b1b9cc 11507->11512 11510 b1e7ee _unexpected 6 API calls 11508->11510 11509 b1e82d _unexpected 6 API calls 11511 b1b9e8 11509->11511 11510->11512 11514 b1bfb4 _unexpected 14 API calls 11511->11514 11531 b1b9d0 SetLastError 11511->11531 11512->11509 11512->11531 11515 b1b9fd 11514->11515 11518 b1ba05 11515->11518 11519 b1ba16 11515->11519 11516 b1ba60 11534 b1f770 11516->11534 11517 b1ba65 11520 b19030 CallUnexpected 41 API calls 11517->11520 11521 b1e82d _unexpected 6 API calls 11518->11521 11522 b1e82d _unexpected 6 API calls 11519->11522 11523 b1ba6a 11520->11523 11524 b1ba13 11521->11524 11525 b1ba22 11522->11525 11528 b1c011 __freea 14 API calls 11524->11528 11526 b1ba26 11525->11526 11527 b1ba3d 11525->11527 11530 b1e82d _unexpected 6 API calls 11526->11530 11529 b1b7de _unexpected 14 API calls 11527->11529 11528->11531 11532 b1ba48 11529->11532 11530->11524 11531->11516 11531->11517 11533 b1c011 __freea 14 API calls 11532->11533 11533->11531 11535 b1f783 11534->11535 11536 b1c701 11534->11536 11535->11536 11542 b1e4a4 11535->11542 11538 b1f7ce 11536->11538 11539 b1f7e1 11538->11539 11540 b1f7f6 11538->11540 11539->11540 11638 b1d069 11539->11638 11540->11500 11543 b1e4b0 __FrameHandler3::FrameUnwindToState 11542->11543 11544 b1b9b0 _unexpected 43 API calls 11543->11544 11545 b1e4b9 11544->11545 11552 b1e4ff 11545->11552 11555 b1d5d1 EnterCriticalSection 11545->11555 11547 b1e4d7 11556 b1e525 11547->11556 11552->11536 11553 b19030 CallUnexpected 43 API calls 11554 b1e524 11553->11554 11555->11547 11557 b1e533 _unexpected 11556->11557 11559 b1e4e8 11556->11559 11557->11559 11563 b1e258 11557->11563 11560 b1e504 11559->11560 11637 b1d619 LeaveCriticalSection 11560->11637 11562 b1e4fb 11562->11552 11562->11553 11564 b1e26e 11563->11564 11566 b1e2d8 11563->11566 11564->11566 11568 b1e2a1 11564->11568 11573 b1c011 __freea 14 API calls 11564->11573 11567 b1c011 __freea 14 API calls 11566->11567 11590 b1e326 11566->11590 11569 b1e2fa 11567->11569 11570 b1e2c3 11568->11570 11578 b1c011 __freea 14 API calls 11568->11578 11571 b1c011 __freea 14 API calls 11569->11571 11572 b1c011 __freea 14 API calls 11570->11572 11574 b1e30d 11571->11574 11575 b1e2cd 11572->11575 11577 b1e296 11573->11577 11579 b1c011 __freea 14 API calls 11574->11579 11580 b1c011 __freea 14 API calls 11575->11580 11576 b1e394 11581 b1c011 __freea 14 API calls 11576->11581 11591 b1daf8 11577->11591 11584 b1e2b8 11578->11584 11585 b1e31b 11579->11585 11580->11566 11586 b1e39a 11581->11586 11583 b1c011 14 API calls __freea 11587 b1e334 11583->11587 11619 b1dbf6 11584->11619 11589 b1c011 __freea 14 API calls 11585->11589 11586->11559 11587->11576 11587->11583 11589->11590 11631 b1e3c9 11590->11631 11592 b1db09 11591->11592 11618 b1dbf2 11591->11618 11593 b1db1a 11592->11593 11594 b1c011 __freea 14 API calls 11592->11594 11595 b1db2c 11593->11595 11596 b1c011 __freea 14 API calls 11593->11596 11594->11593 11597 b1db3e 11595->11597 11598 b1c011 __freea 14 API calls 11595->11598 11596->11595 11599 b1db50 11597->11599 11600 b1c011 __freea 14 API calls 11597->11600 11598->11597 11601 b1db62 11599->11601 11602 b1c011 __freea 14 API calls 11599->11602 11600->11599 11603 b1db74 11601->11603 11604 b1c011 __freea 14 API calls 11601->11604 11602->11601 11605 b1db86 11603->11605 11606 b1c011 __freea 14 API calls 11603->11606 11604->11603 11607 b1c011 __freea 14 API calls 11605->11607 11608 b1db98 11605->11608 11606->11605 11607->11608 11609 b1dbaa 11608->11609 11610 b1c011 __freea 14 API calls 11608->11610 11611 b1dbbc 11609->11611 11612 b1c011 __freea 14 API calls 11609->11612 11610->11609 11613 b1dbce 11611->11613 11614 b1c011 __freea 14 API calls 11611->11614 11612->11611 11615 b1dbe0 11613->11615 11616 b1c011 __freea 14 API calls 11613->11616 11614->11613 11617 b1c011 __freea 14 API calls 11615->11617 11615->11618 11616->11615 11617->11618 11618->11568 11620 b1dc5b 11619->11620 11622 b1dc03 11619->11622 11620->11570 11621 b1dc13 11624 b1dc25 11621->11624 11625 b1c011 __freea 14 API calls 11621->11625 11622->11621 11623 b1c011 __freea 14 API calls 11622->11623 11623->11621 11626 b1dc37 11624->11626 11627 b1c011 __freea 14 API calls 11624->11627 11625->11624 11628 b1dc49 11626->11628 11629 b1c011 __freea 14 API calls 11626->11629 11627->11626 11628->11620 11630 b1c011 __freea 14 API calls 11628->11630 11629->11628 11630->11620 11632 b1e3d6 11631->11632 11636 b1e3f5 11631->11636 11633 b1dc84 _unexpected 14 API calls 11632->11633 11632->11636 11634 b1e3ef 11633->11634 11635 b1c011 __freea 14 API calls 11634->11635 11635->11636 11636->11587 11637->11562 11639 b1b9b0 _unexpected 43 API calls 11638->11639 11640 b1d06e 11639->11640 11641 b1cf81 ___scrt_uninitialize_crt 43 API calls 11640->11641 11642 b1d079 11641->11642 11642->11540 11644 b1cca8 GetCPInfo 11643->11644 11645 b1cd71 11643->11645 11644->11645 11646 b1ccc0 11644->11646 11648 b15a02 _ValidateLocalCookies 5 API calls 11645->11648 11661 b1e0b2 11646->11661 11650 b1ce2a 11648->11650 11650->11483 11653 b20e32 47 API calls 11653->11645 11655 b15a0b IsProcessorFeaturePresent 11654->11655 11656 b15a0a 11654->11656 11658 b15a4d 11655->11658 11656->11480 11734 b15a10 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 11658->11734 11660 b15b30 11660->11480 11662 b1c6ab 43 API calls 11661->11662 11663 b1e0d2 11662->11663 11681 b1d386 11663->11681 11665 b1e196 11667 b15a02 _ValidateLocalCookies 5 API calls 11665->11667 11666 b1e18e 11684 b1e1bb 11666->11684 11670 b1cd28 11667->11670 11668 b1e0ff 11668->11665 11668->11666 11669 b1dd8c 15 API calls 11668->11669 11672 b1e124 CallUnexpected __alloca_probe_16 11668->11672 11669->11672 11676 b20e32 11670->11676 11672->11666 11673 b1d386 ___scrt_uninitialize_crt MultiByteToWideChar 11672->11673 11674 b1e16f 11673->11674 11674->11666 11675 b1e17a GetStringTypeW 11674->11675 11675->11666 11677 b1c6ab 43 API calls 11676->11677 11678 b20e45 11677->11678 11688 b20c44 11678->11688 11682 b1d397 MultiByteToWideChar 11681->11682 11682->11668 11685 b1e1c7 11684->11685 11686 b1e1d8 11684->11686 11685->11686 11687 b1c011 __freea 14 API calls 11685->11687 11686->11665 11687->11686 11689 b20c5f 11688->11689 11690 b1d386 ___scrt_uninitialize_crt MultiByteToWideChar 11689->11690 11693 b20ca5 11690->11693 11691 b20e1d 11692 b15a02 _ValidateLocalCookies 5 API calls 11691->11692 11694 b1cd49 11692->11694 11693->11691 11695 b1dd8c 15 API calls 11693->11695 11697 b20ccb __alloca_probe_16 11693->11697 11715 b20d51 11693->11715 11694->11653 11695->11697 11696 b1e1bb __freea 14 API calls 11696->11691 11698 b1d386 ___scrt_uninitialize_crt MultiByteToWideChar 11697->11698 11697->11715 11699 b20d10 11698->11699 11699->11715 11716 b1e8ba 11699->11716 11702 b20d42 11707 b1e8ba 6 API calls 11702->11707 11702->11715 11703 b20d7a 11704 b20e05 11703->11704 11705 b1dd8c 15 API calls 11703->11705 11708 b20d8c __alloca_probe_16 11703->11708 11706 b1e1bb __freea 14 API calls 11704->11706 11705->11708 11706->11715 11707->11715 11708->11704 11709 b1e8ba 6 API calls 11708->11709 11710 b20dcf 11709->11710 11710->11704 11722 b1d402 11710->11722 11712 b20de9 11712->11704 11713 b20df2 11712->11713 11714 b1e1bb __freea 14 API calls 11713->11714 11714->11715 11715->11696 11725 b1e58f 11716->11725 11720 b1e90b LCMapStringW 11721 b1e8cb 11720->11721 11721->11702 11721->11703 11721->11715 11724 b1d419 WideCharToMultiByte 11722->11724 11724->11712 11726 b1e68e _unexpected 5 API calls 11725->11726 11727 b1e5a5 11726->11727 11727->11721 11728 b1e917 11727->11728 11731 b1e5a9 11728->11731 11730 b1e922 11730->11720 11732 b1e68e _unexpected 5 API calls 11731->11732 11733 b1e5bf 11732->11733 11733->11730 11734->11660 11735->11489 11746 b1d284 11736->11746 11738 b1cb0d 11739 b1d284 43 API calls 11738->11739 11740 b1cb2c 11739->11740 11741 b1c011 __freea 14 API calls 11740->11741 11742 b1cac1 11740->11742 11741->11742 11743 b1cadf 11742->11743 11760 b1d619 LeaveCriticalSection 11743->11760 11745 b1cacd 11745->11445 11747 b1d295 11746->11747 11756 b1d291 __InternalCxxFrameHandler 11746->11756 11748 b1d29c 11747->11748 11752 b1d2af CallUnexpected 11747->11752 11749 b1bfa1 __dosmaperr 14 API calls 11748->11749 11750 b1d2a1 11749->11750 11751 b1bec0 ___std_exception_copy 43 API calls 11750->11751 11751->11756 11753 b1d2e6 11752->11753 11754 b1d2dd 11752->11754 11752->11756 11753->11756 11758 b1bfa1 __dosmaperr 14 API calls 11753->11758 11755 b1bfa1 __dosmaperr 14 API calls 11754->11755 11757 b1d2e2 11755->11757 11756->11738 11759 b1bec0 ___std_exception_copy 43 API calls 11757->11759 11758->11757 11759->11756 11760->11745 11762 b1c6ab 43 API calls 11761->11762 11763 b1d318 11762->11763 11763->11016 11765 b15f10 CallUnexpected 11764->11765 11766 b113df VerSetConditionMask VerSetConditionMask VerSetConditionMask VerifyVersionInfoW 11765->11766 11767 b15a02 _ValidateLocalCookies 5 API calls 11766->11767 11768 b11442 11767->11768 11768->11025 11768->11026 11881 b1278b 11769->11881 11774 b1283a 59 API calls 11775 b118bb 11774->11775 11776 b1283a 59 API calls 11775->11776 11777 b118c3 11776->11777 11778 b1193f 11777->11778 12080 b11dd4 IsUserAnAdmin 11778->12080 11781 b1196e 11785 b11972 11781->11785 12094 b11ecd 11781->12094 11787 b15a02 _ValidateLocalCookies 5 API calls 11785->11787 11789 b11b64 11787->11789 11832 b118ca 11789->11832 11791 b119c1 12122 b1312e 11791->12122 11794 b11a9a 12241 b130f1 11794->12241 11801 b12861 RaiseException 11802 b11a22 PathQuoteSpacesW 11801->11802 12152 b12588 11802->12152 11804 b11a36 CallUnexpected 11805 b11a4a GetModuleFileNameW 11804->11805 11806 b11a62 11805->11806 11807 b11a72 11805->11807 11806->11807 12156 b1155f 11806->12156 11809 b11a81 11807->11809 11810 b11ac2 11807->11810 11812 b11a85 11809->11812 11813 b11a9f 11809->11813 12167 b114da 11810->12167 11815 b123f7 74 API calls 11812->11815 11816 b114da 63 API calls 11813->11816 11818 b11a91 11815->11818 11819 b11abd 11816->11819 12261 b12bb8 11818->12261 12204 b11c77 11819->12204 11823 b11b1a 12225 b1347d 11823->12225 11825 b1278b 68 API calls 11827 b11afd 11825->11827 11826 b11b28 11828 b12bb8 RtlFreeHeap 11826->11828 11829 b114da 63 API calls 11827->11829 11828->11794 11830 b11b0e 11829->11830 11831 b12bb8 RtlFreeHeap 11830->11831 11831->11823 11833 b118db 11832->11833 11844 b11911 11832->11844 11834 b118f8 11833->11834 11836 b125ae RaiseException 11833->11836 11837 b125d3 15 API calls 11834->11837 11835 b12bb8 RtlFreeHeap 11838 b1191e 11835->11838 11839 b118ea DeleteFileW 11836->11839 11840 b118ff RemoveDirectoryW 11837->11840 11841 b12bb8 RtlFreeHeap 11838->11841 11839->11833 11839->11834 11842 b1289d 44 API calls 11840->11842 11843 b11925 11841->11843 11842->11844 11845 b125d3 15 API calls 11843->11845 11844->11835 11846 b1192c 11845->11846 11847 b12bb8 RtlFreeHeap 11846->11847 11848 b11934 11847->11848 11849 b12699 11850 b126a1 11849->11850 11851 b1252a 11849->11851 11850->11851 11852 b126a6 CoUninitialize 11850->11852 11851->11044 11852->11851 11854 b1283a 59 API calls 11853->11854 11855 b12409 11854->11855 11856 b12425 11855->11856 11857 b12416 11855->11857 11859 b1283a 59 API calls 11856->11859 11858 b126ad 51 API calls 11857->11858 11860 b12423 11858->11860 11861 b1242d 11859->11861 11863 b1283a 59 API calls 11860->11863 11862 b126ad 51 API calls 11861->11862 11864 b12436 11862->11864 11865 b1245a 11863->11865 12883 b12df0 11864->12883 11867 b1283a 59 API calls 11865->11867 11869 b12462 11867->11869 11871 b126ad 51 API calls 11869->11871 11870 b12bb8 RtlFreeHeap 11870->11860 11872 b1246b 11871->11872 11873 b12df0 73 API calls 11872->11873 11874 b1247c 11873->11874 11875 b12bb8 RtlFreeHeap 11874->11875 11876 b12487 MessageBoxW 11875->11876 11877 b12bb8 RtlFreeHeap 11876->11877 11878 b1249f 11877->11878 11879 b12bb8 RtlFreeHeap 11878->11879 11880 b124a7 11879->11880 11880->11849 11899 b111d5 11881->11899 11884 b127d0 11932 b1103b 11884->11932 11887 b1279c 11888 b127c1 11887->11888 11889 b127b4 11887->11889 11914 b12a1d 11888->11914 11923 b126ad 11889->11923 11892 b1189d 11893 b1283a 11892->11893 11894 b111d5 58 API calls 11893->11894 11895 b12842 11894->11895 11896 b118a5 11895->11896 11897 b1103b RaiseException 11895->11897 11896->11774 11898 b12860 11897->11898 11900 b11203 11899->11900 11912 b111ec 11899->11912 11938 b26965 EnterCriticalSection 11900->11938 11902 b1120e 11905 b11218 GetProcessHeap 11902->11905 11902->11912 11903 b26965 6 API calls 11904 b11253 11903->11904 11907 b15457 46 API calls 11904->11907 11913 b111fe 11904->11913 11943 b15457 11905->11943 11909 b112a0 11907->11909 11911 b2691b __Init_thread_footer 5 API calls 11909->11911 11911->11913 11912->11903 11912->11913 11913->11884 11913->11887 11915 b12a66 11914->11915 11916 b12a2a MultiByteToWideChar 11914->11916 12004 b1289d 11915->12004 11916->11915 11917 b12a43 11916->11917 12000 b12861 11917->12000 12040 b262fd EnterCriticalSection 11923->12040 11925 b1271f 11925->11892 11926 b126d8 FindResourceExW 11927 b126c2 11926->11927 11927->11925 11927->11926 11929 b262fd 3 API calls 11927->11929 11930 b12710 11927->11930 12045 b110bf LoadResource 11927->12045 11929->11927 11930->11925 12049 b1298f FindResourceW 11930->12049 12079 b11026 RaiseException 11932->12079 11934 b1107a 11935 b1105b 11935->11934 11936 b1103b RaiseException 11935->11936 11937 b11096 11936->11937 11939 b26979 11938->11939 11940 b2697e LeaveCriticalSection 11939->11940 11951 b269ed 11939->11951 11940->11902 11956 b1542a 11943->11956 11946 b2691b EnterCriticalSection LeaveCriticalSection 11947 b269b7 11946->11947 11948 b269c2 RtlWakeAllConditionVariable 11947->11948 11949 b269d3 SetEvent ResetEvent 11947->11949 11948->11912 11949->11912 11952 b26a14 LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 11951->11952 11953 b269fb SleepConditionVariableCS 11951->11953 11954 b26a38 11952->11954 11953->11954 11954->11939 11957 b15440 11956->11957 11958 b15439 11956->11958 11965 b18da5 11957->11965 11962 b18d28 11958->11962 11961 b1123e 11961->11946 11963 b18da5 46 API calls 11962->11963 11964 b18d3a 11963->11964 11964->11961 11968 b18af1 11965->11968 11969 b18afd __FrameHandler3::FrameUnwindToState 11968->11969 11976 b1d5d1 EnterCriticalSection 11969->11976 11971 b18b0b 11977 b18b4c 11971->11977 11973 b18b18 11987 b18b40 11973->11987 11976->11971 11979 b18b67 11977->11979 11986 b18bda _unexpected 11977->11986 11978 b18bba 11981 b1e99d 46 API calls 11978->11981 11978->11986 11979->11978 11979->11986 11990 b1e99d 11979->11990 11983 b18bd0 11981->11983 11982 b18bb0 11984 b1c011 __freea 14 API calls 11982->11984 11985 b1c011 __freea 14 API calls 11983->11985 11984->11978 11985->11986 11986->11973 11999 b1d619 LeaveCriticalSection 11987->11999 11989 b18b29 11989->11961 11991 b1e9c5 11990->11991 11992 b1e9aa 11990->11992 11994 b1e9d4 11991->11994 11996 b20f55 44 API calls 11991->11996 11992->11991 11993 b1e9b6 11992->11993 11995 b1bfa1 __dosmaperr 14 API calls 11993->11995 11997 b20f88 16 API calls 11994->11997 11998 b1e9bb CallUnexpected 11995->11998 11996->11994 11997->11998 11998->11982 11999->11989 12001 b12892 12000->12001 12002 b1103b RaiseException 12001->12002 12003 b1289c 12002->12003 12005 b128af 12004->12005 12006 b128c0 12004->12006 12005->12006 12008 b12ad6 12005->12008 12006->11892 12009 b12ae0 12008->12009 12010 b12ae7 12009->12010 12011 b1103b RaiseException 12009->12011 12010->12006 12012 b12b00 12011->12012 12013 b12b19 12012->12013 12014 b12b0f 12012->12014 12016 b12b23 12013->12016 12017 b12bad 12013->12017 12015 b1289d 44 API calls 12014->12015 12019 b12b14 12015->12019 12020 b12861 RaiseException 12016->12020 12018 b1103b RaiseException 12017->12018 12021 b12bb7 12018->12021 12019->12006 12022 b12b3b 12020->12022 12023 b12b93 12022->12023 12024 b12b49 12022->12024 12034 b12c7d 12023->12034 12026 b12b5a 12024->12026 12028 b12b70 12024->12028 12030 b12b6a __InternalCxxFrameHandler 12024->12030 12029 b1bfa1 __dosmaperr 14 API calls 12026->12029 12027 b12ad6 44 API calls 12027->12019 12028->12030 12032 b1bfa1 __dosmaperr 14 API calls 12028->12032 12031 b12b5f 12029->12031 12030->12027 12033 b1bec0 ___std_exception_copy 43 API calls 12031->12033 12032->12031 12033->12030 12035 b12c8f 12034->12035 12038 b12cb2 __InternalCxxFrameHandler 12034->12038 12036 b1bfa1 __dosmaperr 14 API calls 12035->12036 12037 b12c98 CallUnexpected 12035->12037 12036->12037 12037->12038 12039 b1bfa1 14 API calls __dosmaperr 12037->12039 12038->12030 12039->12037 12042 b26316 12040->12042 12043 b2631f LeaveCriticalSection 12040->12043 12042->12043 12059 b125ae 12042->12059 12043->11927 12046 b110f5 12045->12046 12047 b110d5 LockResource 12045->12047 12046->11927 12047->12046 12048 b110e2 SizeofResource 12047->12048 12048->12046 12050 b129b0 12049->12050 12058 b129f0 12049->12058 12051 b110bf 3 API calls 12050->12051 12052 b129bd 12051->12052 12053 b12861 RaiseException 12052->12053 12052->12058 12054 b129d0 12053->12054 12065 b27b57 12054->12065 12056 b129df 12057 b12ad6 44 API calls 12056->12057 12057->12058 12058->11925 12060 b125b8 12059->12060 12061 b125bd 12060->12061 12064 b11026 RaiseException 12060->12064 12061->12043 12063 b125d2 12064->12063 12066 b27b68 12065->12066 12074 b27b64 __InternalCxxFrameHandler 12065->12074 12067 b27b82 _wmemset 12066->12067 12068 b27b6f 12066->12068 12072 b27bb3 12067->12072 12073 b27bbc 12067->12073 12067->12074 12069 b1bfa1 __dosmaperr 14 API calls 12068->12069 12070 b27b74 12069->12070 12071 b1bec0 ___std_exception_copy 43 API calls 12070->12071 12071->12074 12075 b1bfa1 __dosmaperr 14 API calls 12072->12075 12073->12074 12076 b1bfa1 __dosmaperr 14 API calls 12073->12076 12074->12056 12077 b27bb8 12075->12077 12076->12077 12078 b1bec0 ___std_exception_copy 43 API calls 12077->12078 12078->12074 12079->11935 12081 b11deb 12080->12081 12092 b11963 12080->12092 12082 b1283a 59 API calls 12081->12082 12083 b11df5 12082->12083 12084 b12861 RaiseException 12083->12084 12085 b11e0b SHGetFolderPathW 12084->12085 12086 b12588 44 API calls 12085->12086 12088 b11e26 12086->12088 12087 b11e45 12090 b12bb8 RtlFreeHeap 12087->12090 12088->12087 12265 b11d2b CreateDirectoryW 12088->12265 12090->12092 12092->11781 12248 b11e56 12092->12248 12095 b15f10 CallUnexpected 12094->12095 12096 b11efc GetTempFileNameW 12095->12096 12097 b11fca 12096->12097 12098 b11f1d 12096->12098 12099 b15a02 _ValidateLocalCookies 5 API calls 12097->12099 12284 b127db 12098->12284 12101 b11982 12099->12101 12101->11785 12115 b130b7 12101->12115 12102 b11f2f 12293 b1260c 12102->12293 12105 b12bb8 RtlFreeHeap 12106 b11f49 FindResourceW 12105->12106 12106->12097 12107 b11f5d LoadResource 12106->12107 12107->12097 12108 b11f6a LockResource 12107->12108 12108->12097 12109 b11f77 CreateFileW 12108->12109 12109->12097 12110 b11f98 SizeofResource 12109->12110 12301 b12212 12110->12301 12113 b11fb1 SetFilePointerEx 12113->12097 12114 b11fc0 CloseHandle 12113->12114 12114->12097 12116 b12bd3 15 API calls 12115->12116 12117 b1199e 12116->12117 12118 b11447 12117->12118 12119 b1146d 12118->12119 12120 b15a02 _ValidateLocalCookies 5 API calls 12119->12120 12121 b114d6 12120->12121 12121->11791 12123 b13139 12122->12123 12125 b119d3 12123->12125 12344 b13157 12123->12344 12125->11794 12126 b11fdd 12125->12126 12127 b1283a 59 API calls 12126->12127 12128 b11ff0 12127->12128 12129 b12861 RaiseException 12128->12129 12130 b12007 GetModuleFileNameW 12129->12130 12131 b12588 44 API calls 12130->12131 12132 b1201f 12131->12132 12133 b12066 12132->12133 12135 b127db 66 API calls 12132->12135 12134 b12bb8 RtlFreeHeap 12133->12134 12136 b119e2 12134->12136 12137 b12036 12135->12137 12136->11794 12144 b12bd3 12136->12144 12541 b12531 12137->12541 12140 b12050 12141 b1260c 15 API calls 12140->12141 12143 b1205c 12141->12143 12142 b12bb8 RtlFreeHeap 12142->12133 12143->12142 12145 b12bde 12144->12145 12146 b11a02 12145->12146 12147 b12c20 12145->12147 12148 b12c02 12145->12148 12146->11801 12150 b12da3 RaiseException 12147->12150 12149 b12c7d 14 API calls 12148->12149 12149->12146 12151 b12c25 12150->12151 12153 b12593 12152->12153 12154 b12ad6 44 API calls 12153->12154 12155 b125ac 12154->12155 12155->11804 12157 b11569 12156->12157 12158 b1156d 12156->12158 12157->11807 12548 b12fe1 12158->12548 12160 b11871 12161 b13079 3 API calls 12160->12161 12163 b11882 12161->12163 12163->11807 12164 b11593 12164->12160 12165 b26a3b 3 API calls 12164->12165 12166 b11710 __InternalCxxFrameHandler 12164->12166 12165->12166 12558 b13079 12166->12558 12168 b1283a 59 API calls 12167->12168 12169 b114ea 12168->12169 12170 b12861 RaiseException 12169->12170 12171 b11503 12170->12171 12565 b1b2d8 12171->12565 12174 b12588 44 API calls 12175 b11547 12174->12175 12176 b128e3 44 API calls 12175->12176 12177 b11553 12176->12177 12178 b12bb8 RtlFreeHeap 12177->12178 12179 b1155b 12178->12179 12180 b11b68 12179->12180 12181 b1283a 59 API calls 12180->12181 12182 b11b94 12181->12182 12183 b114da 63 API calls 12182->12183 12184 b11baa 12183->12184 12185 b11bc4 12184->12185 12186 b11bd7 12184->12186 12187 b12bd3 15 API calls 12185->12187 12188 b129fe 58 API calls 12186->12188 12191 b11bcc 12187->12191 12189 b11bdf 12188->12189 12190 b12a75 44 API calls 12189->12190 12190->12191 12192 b12bb8 RtlFreeHeap 12191->12192 12193 b11c0b 12192->12193 12194 b11c5b 12193->12194 12195 b11c0f CallUnexpected 12193->12195 12196 b12bb8 RtlFreeHeap 12194->12196 12197 b11c21 GetModuleFileNameW 12195->12197 12198 b11c66 12196->12198 12197->12194 12199 b11c3d 12197->12199 12199->12194 12205 b1283a 59 API calls 12204->12205 12206 b11c86 12205->12206 12207 b114da 63 API calls 12206->12207 12208 b11c99 12207->12208 12209 b11cc7 12208->12209 12210 b11cb7 12208->12210 12212 b129fe 58 API calls 12209->12212 12211 b12bd3 15 API calls 12210->12211 12213 b11cbf lstrcmpiW 12211->12213 12214 b11cce 12212->12214 12217 b12bb8 RtlFreeHeap 12213->12217 12216 b12a75 44 API calls 12214->12216 12216->12213 12218 b11cf8 12217->12218 12219 b12861 RaiseException 12218->12219 12224 b11d14 12218->12224 12221 b11d0c 12219->12221 12220 b12bb8 RtlFreeHeap 12223 b11aeb 12220->12223 12222 b12ad6 44 API calls 12221->12222 12222->12224 12223->11823 12223->11825 12224->12220 12226 b12bd3 15 API calls 12225->12226 12227 b13493 CallUnexpected 12226->12227 12228 b134a7 GetStartupInfoW 12227->12228 12229 b134d0 12228->12229 12230 b134de CreateProcessW 12228->12230 12856 b12d29 12229->12856 12232 b13509 WaitForSingleObject 12230->12232 12233 b134fc GetLastError 12230->12233 12236 b1351b GetExitCodeProcess 12232->12236 12237 b1352c 12232->12237 12235 b1353f 12233->12235 12239 b12bb8 RtlFreeHeap 12235->12239 12238 b1352f CloseHandle CloseHandle 12236->12238 12237->12238 12238->12235 12240 b13547 12239->12240 12240->11826 12242 b130fd 12241->12242 12245 b13114 12241->12245 12243 b125ae RaiseException 12242->12243 12244 b13106 DeleteFileW 12243->12244 12244->12242 12244->12245 12871 b125d3 12245->12871 12249 b1283a 59 API calls 12248->12249 12250 b11e69 12249->12250 12251 b12861 RaiseException 12250->12251 12252 b11e80 GetTempPathW 12251->12252 12253 b12588 44 API calls 12252->12253 12254 b11e95 12253->12254 12255 b11d2b 65 API calls 12254->12255 12260 b11eb8 12254->12260 12257 b11ea8 12255->12257 12256 b12bb8 RtlFreeHeap 12258 b11ec6 12256->12258 12259 b1272a 15 API calls 12257->12259 12257->12260 12258->11781 12259->12260 12260->12256 12262 b12bd2 12261->12262 12263 b12bca 12261->12263 12262->11794 12880 b1114d 12263->12880 12266 b11d59 12265->12266 12267 b11d48 GetLastError 12265->12267 12268 b1283a 59 API calls 12266->12268 12267->12266 12277 b11d55 12267->12277 12269 b11d61 12268->12269 12270 b12861 RaiseException 12269->12270 12271 b11d77 GetTempFileNameW 12270->12271 12272 b12588 44 API calls 12271->12272 12273 b11d93 12272->12273 12275 b11d9c DeleteFileW CreateDirectoryW 12273->12275 12279 b11dc2 12273->12279 12274 b12bb8 RtlFreeHeap 12274->12277 12276 b11db3 12275->12276 12275->12279 12278 b1272a 15 API calls 12276->12278 12277->12087 12280 b1272a 12277->12280 12278->12279 12279->12274 12281 b12742 12280->12281 12282 b12756 12280->12282 12281->12282 12283 b12bd3 15 API calls 12281->12283 12282->12087 12283->12282 12285 b111d5 58 API calls 12284->12285 12286 b127e7 12285->12286 12287 b1282f 12286->12287 12290 b127ed 12286->12290 12288 b1103b RaiseException 12287->12288 12289 b12839 12288->12289 12291 b126ad 51 API calls 12290->12291 12292 b12811 12290->12292 12291->12292 12292->12102 12294 b1261e 12293->12294 12300 b1262e 12293->12300 12297 b1268e 12294->12297 12294->12300 12295 b11f3e 12295->12105 12296 b12bd3 15 API calls 12296->12295 12298 b1103b RaiseException 12297->12298 12299 b12698 12298->12299 12300->12295 12300->12296 12302 b12242 12301->12302 12313 b1223a 12301->12313 12315 b14cb6 12302->12315 12305 b15a02 _ValidateLocalCookies 5 API calls 12306 b11fac 12305->12306 12306->12113 12306->12114 12308 b122a9 12309 b26a3b 3 API calls 12308->12309 12308->12313 12310 b12361 12309->12310 12330 b14d2c 12310->12330 12313->12305 12314 b123a8 WriteFile 12314->12313 12316 b14cca 12315->12316 12319 b12270 12316->12319 12334 b14c63 12316->12334 12321 b26a3b 12319->12321 12322 b26a44 ___std_exception_copy 12321->12322 12323 b26a63 12322->12323 12324 b1eacd _unexpected 2 API calls 12322->12324 12326 b26a65 12322->12326 12323->12308 12324->12322 12325 b26af6 12327 b17dc6 CallUnexpected RaiseException 12325->12327 12326->12325 12341 b17dc6 12326->12341 12329 b26b13 12327->12329 12333 b14d90 12330->12333 12331 b15a02 _ValidateLocalCookies 5 API calls 12332 b12396 12331->12332 12332->12313 12332->12314 12333->12331 12335 b14c82 12334->12335 12336 b14c9d 12335->12336 12337 b121f6 3 API calls 12335->12337 12336->12319 12338 b121f6 12336->12338 12337->12336 12339 b26a3b 3 API calls 12338->12339 12340 b12201 12339->12340 12340->12319 12342 b17de0 12341->12342 12343 b17e0d RaiseException 12341->12343 12342->12343 12343->12325 12386 b26790 12344->12386 12347 b15a02 _ValidateLocalCookies 5 API calls 12348 b13412 12347->12348 12348->12123 12349 b131a7 12350 b12bd3 15 API calls 12349->12350 12378 b131d1 12349->12378 12351 b13201 12350->12351 12388 b13416 12351->12388 12354 b13416 69 API calls 12355 b1322c 12354->12355 12356 b13281 12355->12356 12404 b12f8b 12355->12404 12357 b12bd3 15 API calls 12356->12357 12362 b13271 12357->12362 12359 b13261 12360 b1278b 68 API calls 12359->12360 12360->12362 12361 b12bd3 15 API calls 12363 b132a3 12361->12363 12362->12361 12364 b132bf 12363->12364 12365 b12bb8 RtlFreeHeap 12363->12365 12366 b132ce CreateFileW 12364->12366 12369 b12bb8 RtlFreeHeap 12364->12369 12365->12364 12367 b133e3 12366->12367 12368 b132f8 12366->12368 12371 b12bb8 RtlFreeHeap 12367->12371 12407 b27c47 12368->12407 12369->12366 12373 b133f4 12371->12373 12376 b12bb8 RtlFreeHeap 12373->12376 12374 b13335 12377 b1334c ReadFile 12374->12377 12381 b133a2 12374->12381 12375 b133aa FindCloseChangeNotification 12379 b133d2 12375->12379 12380 b133be 12375->12380 12376->12378 12377->12381 12382 b13369 WriteFile 12377->12382 12378->12347 12379->12367 12383 b133d7 SetFilePointer 12379->12383 12380->12379 12384 b1260c 15 API calls 12380->12384 12381->12375 12382->12374 12382->12381 12383->12367 12384->12379 12387 b13164 ReadFile 12386->12387 12387->12349 12387->12378 12413 b129fe 12388->12413 12391 b13472 12393 b1103b RaiseException 12391->12393 12392 b13428 12395 b1344f 12392->12395 12396 b13441 12392->12396 12394 b1347c 12393->12394 12397 b12a1d 46 API calls 12395->12397 12398 b126ad 51 API calls 12396->12398 12399 b1344d 12397->12399 12398->12399 12417 b128e3 12399->12417 12402 b12bb8 RtlFreeHeap 12403 b1321a 12402->12403 12403->12354 12429 b12075 12404->12429 12405 b12f9d 12405->12356 12405->12359 12408 b27c5a ___std_exception_copy 12407->12408 12480 b1b319 12408->12480 12410 b27c7b 12411 b1a270 ___std_exception_copy 43 API calls 12410->12411 12412 b13307 SetFilePointer 12411->12412 12412->12374 12412->12375 12414 b12a07 12413->12414 12415 b111d5 58 API calls 12414->12415 12416 b12a15 12414->12416 12415->12416 12416->12391 12416->12392 12418 b12966 12417->12418 12421 b12909 12417->12421 12419 b1103b RaiseException 12418->12419 12420 b12970 12419->12420 12421->12418 12422 b1292f 12421->12422 12423 b12861 RaiseException 12422->12423 12424 b1293c 12423->12424 12425 b12c7d 14 API calls 12424->12425 12426 b12952 12425->12426 12427 b12ad6 44 API calls 12426->12427 12428 b1295f 12427->12428 12428->12402 12430 b127db 66 API calls 12429->12430 12431 b1208e 12430->12431 12432 b1260c 15 API calls 12431->12432 12433 b1209a 12432->12433 12434 b12118 12433->12434 12436 b120cf 12433->12436 12435 b12bd3 15 API calls 12434->12435 12451 b12113 12435->12451 12438 b1216d 12436->12438 12442 b129fe 58 API calls 12436->12442 12437 b12861 RaiseException 12439 b12132 12437->12439 12440 b1103b RaiseException 12438->12440 12439->12438 12441 b12141 CharLowerBuffW 12439->12441 12443 b121e3 12440->12443 12444 b12ad6 44 API calls 12441->12444 12445 b12105 12442->12445 12446 b12075 67 API calls 12443->12446 12447 b12152 12444->12447 12464 b12a75 12445->12464 12449 b121f2 12446->12449 12447->12438 12450 b121c2 12447->12450 12453 b12174 12447->12453 12449->12405 12452 b12bb8 RtlFreeHeap 12450->12452 12451->12437 12454 b121ca 12452->12454 12456 b129fe 58 API calls 12453->12456 12455 b12bb8 RtlFreeHeap 12454->12455 12457 b121d2 12455->12457 12458 b12182 12456->12458 12457->12405 12459 b12a75 44 API calls 12458->12459 12460 b12190 12459->12460 12461 b121ba 12460->12461 12463 b1272a 15 API calls 12460->12463 12462 b12bb8 RtlFreeHeap 12461->12462 12462->12450 12463->12461 12465 b12a83 12464->12465 12466 b12a90 12464->12466 12465->12466 12468 b12a97 12465->12468 12467 b1103b RaiseException 12466->12467 12469 b12ad0 12467->12469 12468->12469 12471 b12aa2 12468->12471 12477 b12da3 12469->12477 12473 b12ad6 44 API calls 12471->12473 12474 b12aaf 12473->12474 12475 b12c7d 14 API calls 12474->12475 12476 b12abc 12475->12476 12476->12451 12478 b1103b RaiseException 12477->12478 12479 b12dad 12478->12479 12494 b1b21b 12480->12494 12482 b1b373 12488 b1b397 12482->12488 12501 b1b1c0 12482->12501 12483 b1b340 12485 b1be43 ___std_exception_copy 43 API calls 12483->12485 12484 b1b32b 12484->12482 12484->12483 12493 b1b35b 12484->12493 12485->12493 12490 b1b3bb 12488->12490 12508 b1b560 12488->12508 12489 b1b443 12491 b1b169 43 API calls 12489->12491 12490->12489 12515 b1b169 12490->12515 12491->12493 12493->12410 12495 b1b220 12494->12495 12496 b1b233 12494->12496 12497 b1bfa1 __dosmaperr 14 API calls 12495->12497 12496->12484 12498 b1b225 12497->12498 12499 b1bec0 ___std_exception_copy 43 API calls 12498->12499 12500 b1b230 12499->12500 12500->12484 12502 b1a430 ___std_exception_copy 43 API calls 12501->12502 12503 b1b1d0 12502->12503 12521 b1f79d 12503->12521 12509 b1b582 12508->12509 12510 b1b56c 12508->12510 12511 b1b592 12509->12511 12534 b204e5 12509->12534 12529 b1dd68 12510->12529 12511->12488 12513 b1b577 12513->12488 12516 b1b17a 12515->12516 12517 b1b18e 12515->12517 12516->12517 12518 b1bfa1 __dosmaperr 14 API calls 12516->12518 12517->12489 12519 b1b183 12518->12519 12520 b1bec0 ___std_exception_copy 43 API calls 12519->12520 12520->12517 12522 b1f7b4 12521->12522 12523 b1b1ed 12521->12523 12522->12523 12524 b1e4a4 ___scrt_uninitialize_crt 43 API calls 12522->12524 12525 b1f7fb 12523->12525 12524->12523 12526 b1f812 12525->12526 12528 b1b1fa 12525->12528 12527 b1d069 ___scrt_uninitialize_crt 43 API calls 12526->12527 12526->12528 12527->12528 12528->12488 12530 b1b9b0 _unexpected 43 API calls 12529->12530 12531 b1dd73 12530->12531 12532 b1f770 43 API calls 12531->12532 12533 b1dd83 12532->12533 12533->12513 12535 b1c6ab 43 API calls 12534->12535 12537 b20502 12535->12537 12536 b20512 12539 b15a02 _ValidateLocalCookies 5 API calls 12536->12539 12537->12536 12538 b1e0b2 46 API calls 12537->12538 12538->12536 12540 b205ae 12539->12540 12540->12511 12542 b12861 RaiseException 12541->12542 12543 b1253f PathAppendW 12542->12543 12544 b12553 12543->12544 12545 b1203f CopyFileW 12544->12545 12546 b1103b RaiseException 12544->12546 12545->12140 12545->12143 12547 b12587 12546->12547 12549 b13079 3 API calls 12548->12549 12550 b12ff0 CreateFileW 12549->12550 12551 b13057 12550->12551 12552 b13013 CreateFileMappingW 12550->12552 12551->12164 12553 b13027 MapViewOfFile 12552->12553 12554 b1306a 12552->12554 12556 b13061 CloseHandle 12553->12556 12557 b1303c VirtualQuery 12553->12557 12555 b13079 3 API calls 12554->12555 12555->12551 12556->12554 12557->12551 12557->12556 12559 b13082 UnmapViewOfFile 12558->12559 12560 b1308f 12558->12560 12559->12560 12561 b130a2 12560->12561 12562 b13095 CloseHandle 12560->12562 12563 b130b5 12561->12563 12564 b130a8 CloseHandle 12561->12564 12562->12561 12563->12160 12564->12563 12566 b1b2ec ___std_exception_copy 12565->12566 12571 b1907f 12566->12571 12569 b1a270 ___std_exception_copy 43 API calls 12570 b11529 12569->12570 12570->12174 12572 b190ab 12571->12572 12573 b190ce 12571->12573 12574 b1be43 ___std_exception_copy 43 API calls 12572->12574 12573->12572 12577 b190d6 12573->12577 12575 b190c3 12574->12575 12576 b15a02 _ValidateLocalCookies 5 API calls 12575->12576 12578 b19200 12576->12578 12582 b1a506 12577->12582 12578->12569 12595 b1b236 12582->12595 12585 b1a529 12586 b1be43 ___std_exception_copy 43 API calls 12585->12586 12587 b19157 12586->12587 12592 b1a2ac 12587->12592 12589 b1a553 12589->12587 12599 b1a48c 12589->12599 12602 b1a746 12589->12602 12643 b1a8d4 12589->12643 12593 b1c011 __freea 14 API calls 12592->12593 12594 b1a2bc 12593->12594 12594->12575 12596 b1a51b 12595->12596 12597 b1b241 12595->12597 12596->12585 12596->12587 12596->12589 12598 b1be43 ___std_exception_copy 43 API calls 12597->12598 12598->12596 12679 b193d0 12599->12679 12601 b1a4c9 12601->12589 12603 b1a754 12602->12603 12604 b1a76c 12602->12604 12605 b1a96e 12603->12605 12606 b1a8fe 12603->12606 12616 b1a7ad 12603->12616 12607 b1be43 ___std_exception_copy 43 API calls 12604->12607 12604->12616 12611 b1a9c1 12605->12611 12612 b1a973 12605->12612 12608 b1a904 12606->12608 12609 b1a99b 12606->12609 12610 b1a7a1 12607->12610 12615 b1a94b 12608->12615 12619 b1a90a 12608->12619 12623 b1a940 12608->12623 12720 b19b3f 12609->12720 12610->12589 12613 b1a925 12611->12613 12614 b1a9ca 12611->12614 12617 b1a9b5 12612->12617 12618 b1a975 12612->12618 12642 b1a939 12613->12642 12695 b1b0a1 12613->12695 12614->12609 12614->12623 12624 b1a9a9 12615->12624 12627 b1a955 12615->12627 12639 b1a931 12615->12639 12616->12589 12737 b1b08b 12617->12737 12618->12624 12625 b1a97a 12618->12625 12619->12624 12619->12627 12629 b1a917 12619->12629 12623->12642 12699 b19cc1 12623->12699 12727 b1ada3 12624->12727 12625->12609 12628 b1a97f 12625->12628 12627->12642 12706 b1af43 12627->12706 12631 b1a992 12628->12631 12632 b1a984 12628->12632 12629->12613 12629->12624 12629->12642 12716 b1afea 12631->12716 12632->12642 12712 b1b06e 12632->12712 12634 b15a02 _ValidateLocalCookies 5 API calls 12637 b1acf3 12634->12637 12637->12589 12638 b1b1c0 ___scrt_uninitialize_crt 43 API calls 12641 b1abd7 12638->12641 12639->12638 12639->12641 12639->12642 12641->12642 12740 b20376 12641->12740 12642->12634 12644 b1a96e 12643->12644 12645 b1a8fe 12643->12645 12648 b1a9c1 12644->12648 12649 b1a973 12644->12649 12646 b1a904 12645->12646 12647 b1a99b 12645->12647 12652 b1a94b 12646->12652 12655 b1a940 12646->12655 12656 b1a90a 12646->12656 12657 b19b3f 44 API calls 12647->12657 12650 b1a925 12648->12650 12651 b1a9ca 12648->12651 12653 b1a9b5 12649->12653 12654 b1a975 12649->12654 12658 b1b0a1 43 API calls 12650->12658 12678 b1a939 12650->12678 12651->12647 12651->12655 12659 b1a9a9 12652->12659 12662 b1a955 12652->12662 12674 b1a931 12652->12674 12661 b1b08b 44 API calls 12653->12661 12654->12659 12660 b1a97a 12654->12660 12666 b19cc1 44 API calls 12655->12666 12655->12678 12656->12659 12656->12662 12665 b1a917 12656->12665 12657->12674 12658->12674 12663 b1ada3 46 API calls 12659->12663 12660->12647 12664 b1a97f 12660->12664 12661->12674 12670 b1af43 44 API calls 12662->12670 12662->12678 12663->12674 12667 b1a992 12664->12667 12668 b1a984 12664->12668 12665->12650 12665->12659 12665->12678 12666->12674 12669 b1afea 43 API calls 12667->12669 12672 b1b06e 44 API calls 12668->12672 12668->12678 12669->12674 12670->12674 12671 b15a02 _ValidateLocalCookies 5 API calls 12673 b1acf3 12671->12673 12672->12674 12673->12589 12675 b1b1c0 ___scrt_uninitialize_crt 43 API calls 12674->12675 12677 b1abd7 12674->12677 12674->12678 12675->12677 12676 b20376 ___scrt_uninitialize_crt 44 API calls 12676->12677 12677->12676 12677->12678 12678->12671 12680 b1b21b 43 API calls 12679->12680 12681 b193e6 12680->12681 12682 b193fb 12681->12682 12686 b1942e 12681->12686 12688 b19416 12681->12688 12683 b1be43 ___std_exception_copy 43 API calls 12682->12683 12683->12688 12684 b1972d 12685 b1b192 43 API calls 12684->12685 12685->12688 12686->12684 12689 b1b192 12686->12689 12688->12601 12690 b1b1a7 12689->12690 12691 b1b1bc 12689->12691 12690->12691 12692 b1bfa1 __dosmaperr 14 API calls 12690->12692 12691->12684 12693 b1b1b1 12692->12693 12694 b1bec0 ___std_exception_copy 43 API calls 12693->12694 12694->12691 12696 b1b0bd 12695->12696 12698 b1b0db 12696->12698 12752 b1b114 12696->12752 12698->12639 12700 b19cd5 12699->12700 12701 b19cf7 12700->12701 12703 b19d1e 12700->12703 12702 b1be43 ___std_exception_copy 43 API calls 12701->12702 12705 b19d14 12702->12705 12703->12705 12756 b192b4 12703->12756 12705->12639 12707 b1af6f 12706->12707 12708 b1b1c0 ___scrt_uninitialize_crt 43 API calls 12707->12708 12709 b1af8b 12707->12709 12710 b1afac 12707->12710 12708->12709 12711 b20376 ___scrt_uninitialize_crt 44 API calls 12709->12711 12710->12639 12711->12710 12713 b1b07a 12712->12713 12770 b199bd 12713->12770 12715 b1b08a 12715->12639 12719 b1afff 12716->12719 12717 b1be43 ___std_exception_copy 43 API calls 12718 b1b020 12717->12718 12718->12639 12719->12717 12719->12718 12721 b19b53 12720->12721 12722 b19b75 12721->12722 12724 b19b9c 12721->12724 12723 b1be43 ___std_exception_copy 43 API calls 12722->12723 12726 b19b92 12723->12726 12725 b192b4 15 API calls 12724->12725 12724->12726 12725->12726 12726->12639 12728 b1adc4 12727->12728 12777 b19233 12728->12777 12730 b1ae08 12788 b201f5 12730->12788 12733 b1aeb5 12735 b1b1c0 ___scrt_uninitialize_crt 43 API calls 12733->12735 12736 b1aef1 12733->12736 12734 b1b1c0 ___scrt_uninitialize_crt 43 API calls 12734->12733 12735->12736 12736->12639 12736->12736 12738 b19cc1 44 API calls 12737->12738 12739 b1b0a0 12738->12739 12739->12639 12741 b2038a 12740->12741 12749 b2039a 12740->12749 12742 b203bf 12741->12742 12743 b1b1c0 ___scrt_uninitialize_crt 43 API calls 12741->12743 12741->12749 12744 b203f3 12742->12744 12745 b203d0 12742->12745 12743->12742 12747 b2041b 12744->12747 12748 b2046f 12744->12748 12744->12749 12849 b239aa 12745->12849 12747->12749 12751 b1d386 ___scrt_uninitialize_crt MultiByteToWideChar 12747->12751 12750 b1d386 ___scrt_uninitialize_crt MultiByteToWideChar 12748->12750 12749->12641 12750->12749 12751->12749 12753 b1b127 12752->12753 12755 b1b12e 12752->12755 12754 b1b1c0 ___scrt_uninitialize_crt 43 API calls 12753->12754 12754->12755 12755->12698 12757 b192c9 12756->12757 12758 b192db 12756->12758 12757->12705 12758->12757 12759 b1dd8c 15 API calls 12758->12759 12760 b19300 12759->12760 12761 b19313 12760->12761 12762 b19308 12760->12762 12767 b1a2c6 12761->12767 12763 b1c011 __freea 14 API calls 12762->12763 12763->12757 12766 b1c011 __freea 14 API calls 12766->12757 12768 b1c011 __freea 14 API calls 12767->12768 12769 b1931e 12768->12769 12769->12766 12771 b199d1 12770->12771 12772 b199f3 12771->12772 12774 b19a1a 12771->12774 12773 b1be43 ___std_exception_copy 43 API calls 12772->12773 12776 b19a10 12773->12776 12775 b192b4 15 API calls 12774->12775 12774->12776 12775->12776 12776->12715 12778 b1925a 12777->12778 12787 b19248 12777->12787 12779 b1dd8c 15 API calls 12778->12779 12778->12787 12780 b1927e 12779->12780 12781 b19291 12780->12781 12782 b19286 12780->12782 12784 b1a2c6 14 API calls 12781->12784 12783 b1c011 __freea 14 API calls 12782->12783 12783->12787 12785 b1929c 12784->12785 12786 b1c011 __freea 14 API calls 12785->12786 12786->12787 12787->12730 12789 b2022a 12788->12789 12791 b20206 12788->12791 12790 b2025d 12789->12790 12789->12791 12793 b20296 12790->12793 12794 b202c5 12790->12794 12792 b1be43 ___std_exception_copy 43 API calls 12791->12792 12801 b1ae92 12792->12801 12807 b20099 12793->12807 12795 b202ee 12794->12795 12796 b202f3 12794->12796 12798 b20355 12795->12798 12799 b2031b 12795->12799 12815 b1f931 12796->12815 12842 b1fc5d 12798->12842 12802 b20320 12799->12802 12803 b2033b 12799->12803 12801->12733 12801->12734 12825 b1ffca 12802->12825 12835 b1fe46 12803->12835 12808 b200af 12807->12808 12809 b200ba 12807->12809 12808->12801 12810 b18fd6 ___std_exception_copy 43 API calls 12809->12810 12811 b20115 12810->12811 12816 b1f944 12815->12816 12817 b1f953 12816->12817 12818 b1f975 12816->12818 12819 b1be43 ___std_exception_copy 43 API calls 12817->12819 12820 b1f98f 12818->12820 12822 b1f9e4 12818->12822 12836 b22438 45 API calls 12835->12836 12843 b22438 45 API calls 12842->12843 12852 b245dd 12849->12852 12855 b24608 ___scrt_uninitialize_crt 12852->12855 12853 b15a02 _ValidateLocalCookies 5 API calls 12854 b239c5 12853->12854 12854->12749 12855->12853 12857 b12d48 12856->12857 12866 b112ad 12857->12866 12859 b12d9d 12861 b12da3 RaiseException 12859->12861 12860 b12d5d 12863 b12c7d 14 API calls 12860->12863 12862 b12da2 12861->12862 12864 b12d74 12863->12864 12864->12230 12867 b112f2 12866->12867 12868 b112bb 12866->12868 12867->12859 12867->12860 12868->12867 12870 b11138 RtlAllocateHeap 12868->12870 12870->12867 12872 b125ff 12871->12872 12875 b125df 12871->12875 12873 b12bb8 RtlFreeHeap 12873->12875 12875->12873 12876 b125f7 12875->12876 12877 b18fb0 12876->12877 12878 b1c011 __freea 14 API calls 12877->12878 12879 b18fc8 12878->12879 12879->12872 12881 b11164 12880->12881 12882 b11156 RtlFreeHeap 12880->12882 12881->12262 12882->12881 12884 b129fe 58 API calls 12883->12884 12885 b12dfd 12884->12885 12888 b126ad 51 API calls 12885->12888 12891 b12e47 12885->12891 12886 b1103b RaiseException 12887 b12e58 12886->12887 12889 b12e19 12888->12889 12890 b12e26 12889->12890 12889->12891 12896 b12e59 GetLastError SetLastError FormatMessageW 12890->12896 12891->12886 12893 b12e39 12894 b12bb8 RtlFreeHeap 12893->12894 12895 b12447 12894->12895 12895->11870 12897 b12ea8 SetLastError 12896->12897 12898 b12e9e GetLastError 12896->12898 12900 b12eb8 12897->12900 12901 b12f4d 12897->12901 12898->12897 12899 b12f64 12898->12899 12903 b12da3 RaiseException 12899->12903 12900->12901 12906 b12ec9 12900->12906 12902 b1289d 44 API calls 12901->12902 12904 b12f54 LocalFree 12902->12904 12905 b12f69 _AnonymousOriginator 12903->12905 12904->12893 12905->12893 12907 b12861 RaiseException 12906->12907 12908 b12ee0 12907->12908 12909 b12f36 12908->12909 12910 b12eee 12908->12910 12911 b12c7d 14 API calls 12909->12911 12912 b12eff 12910->12912 12916 b12f15 12910->12916 12918 b12f0f __InternalCxxFrameHandler 12910->12918 12911->12918 12914 b1bfa1 __dosmaperr 14 API calls 12912->12914 12913 b12ad6 44 API calls 12915 b12f4b 12913->12915 12917 b12f04 12914->12917 12915->12904 12916->12918 12919 b1bfa1 __dosmaperr 14 API calls 12916->12919 12920 b1bec0 ___std_exception_copy 43 API calls 12917->12920 12918->12913 12919->12917 12920->12918 12922 b1873b 12921->12922 12923 b1874d 12921->12923 12925 b156cd CallUnexpected GetModuleHandleW 12922->12925 12933 b185d6 12923->12933 12926 b18740 12925->12926 12926->12923 12948 b187f8 GetModuleHandleExW 12926->12948 12928 b15208 12928->11059 12934 b185e2 __FrameHandler3::FrameUnwindToState 12933->12934 12954 b1d5d1 EnterCriticalSection 12934->12954 12936 b185ec 12955 b18623 12936->12955 12938 b185f9 12959 b18617 12938->12959 12941 b187a5 12984 b187d6 12941->12984 12944 b187c3 12946 b187f8 CallUnexpected 3 API calls 12944->12946 12945 b187b3 GetCurrentProcess TerminateProcess 12945->12944 12947 b187cb ExitProcess 12946->12947 12949 b18837 GetProcAddress 12948->12949 12950 b18858 12948->12950 12949->12950 12951 b1884b 12949->12951 12952 b1874c 12950->12952 12953 b1885e FreeLibrary 12950->12953 12951->12950 12952->12923 12953->12952 12954->12936 12956 b1862f __FrameHandler3::FrameUnwindToState 12955->12956 12957 b18696 CallUnexpected 12956->12957 12962 b18d3e 12956->12962 12957->12938 12983 b1d619 LeaveCriticalSection 12959->12983 12961 b18605 12961->12928 12961->12941 12963 b18d4a __EH_prolog3 12962->12963 12966 b18a96 12963->12966 12965 b18d71 CallUnexpected 12965->12957 12967 b18aa2 __FrameHandler3::FrameUnwindToState 12966->12967 12974 b1d5d1 EnterCriticalSection 12967->12974 12969 b18ab0 12975 b18c4e 12969->12975 12974->12969 12976 b18c6d 12975->12976 12977 b18abd 12975->12977 12976->12977 12978 b1c011 __freea 14 API calls 12976->12978 12979 b18ae5 12977->12979 12978->12977 12982 b1d619 LeaveCriticalSection 12979->12982 12981 b18ace 12981->12965 12982->12981 12983->12961 12989 b1d630 GetPEB 12984->12989 12987 b187e0 GetPEB 12988 b187af 12987->12988 12988->12944 12988->12945 12990 b187db 12989->12990 12991 b1d64a 12989->12991 12990->12987 12990->12988 12993 b1e711 12991->12993 12994 b1e68e _unexpected 5 API calls 12993->12994 12995 b1e72d 12994->12995 12995->12990 12997 b18ef0 12996->12997 12999 b18f02 ___scrt_uninitialize_crt 12996->12999 12998 b18efe 12997->12998 13001 b1f107 12997->13001 12998->11053 12999->11053 13004 b1ef94 13001->13004 13007 b1eee8 13004->13007 13008 b1eef4 __FrameHandler3::FrameUnwindToState 13007->13008 13015 b1d5d1 EnterCriticalSection 13008->13015 13010 b1ef6a 13024 b1ef88 13010->13024 13013 b1eefe ___scrt_uninitialize_crt 13013->13010 13016 b1ee5c 13013->13016 13015->13013 13017 b1ee68 __FrameHandler3::FrameUnwindToState 13016->13017 13027 b1f224 EnterCriticalSection 13017->13027 13019 b1ee72 ___scrt_uninitialize_crt 13020 b1eebe 13019->13020 13028 b1f0a2 13019->13028 13041 b1eedc 13020->13041 13143 b1d619 LeaveCriticalSection 13024->13143 13026 b1ef76 13026->12998 13027->13019 13029 b1f0b7 ___std_exception_copy 13028->13029 13030 b1f0c9 13029->13030 13031 b1f0be 13029->13031 13044 b1f039 13030->13044 13032 b1ef94 ___scrt_uninitialize_crt 72 API calls 13031->13032 13040 b1f0c4 13032->13040 13035 b1a270 ___std_exception_copy 43 API calls 13037 b1f101 13035->13037 13037->13020 13038 b1f0ea 13057 b21093 13038->13057 13040->13035 13142 b1f238 LeaveCriticalSection 13041->13142 13043 b1eeca 13043->13013 13045 b1f052 13044->13045 13046 b1f079 13044->13046 13045->13046 13047 b204a9 ___scrt_uninitialize_crt 43 API calls 13045->13047 13046->13040 13050 b204a9 13046->13050 13048 b1f06e 13047->13048 13068 b218be 13048->13068 13051 b204b5 13050->13051 13052 b204ca 13050->13052 13053 b1bfa1 __dosmaperr 14 API calls 13051->13053 13052->13038 13054 b204ba 13053->13054 13055 b1bec0 ___std_exception_copy 43 API calls 13054->13055 13056 b204c5 13055->13056 13056->13038 13058 b210b1 13057->13058 13059 b210a4 13057->13059 13061 b210fa 13058->13061 13064 b210d8 13058->13064 13060 b1bfa1 __dosmaperr 14 API calls 13059->13060 13067 b210a9 13060->13067 13062 b1bfa1 __dosmaperr 14 API calls 13061->13062 13063 b210ff 13062->13063 13065 b1bec0 ___std_exception_copy 43 API calls 13063->13065 13109 b20ff1 13064->13109 13065->13067 13067->13040 13070 b218ca __FrameHandler3::FrameUnwindToState 13068->13070 13069 b218d2 13069->13046 13070->13069 13071 b2198e 13070->13071 13073 b2191f 13070->13073 13072 b1be43 ___std_exception_copy 43 API calls 13071->13072 13072->13069 13079 b1d7af EnterCriticalSection 13073->13079 13075 b21925 13076 b21942 13075->13076 13080 b219c6 13075->13080 13106 b21986 13076->13106 13079->13075 13081 b219eb 13080->13081 13104 b21a0e ___scrt_uninitialize_crt 13080->13104 13082 b219ef 13081->13082 13084 b21a4d 13081->13084 13083 b1be43 ___std_exception_copy 43 API calls 13082->13083 13083->13104 13085 b21a64 13084->13085 13086 b23b94 ___scrt_uninitialize_crt 45 API calls 13084->13086 13087 b2154a ___scrt_uninitialize_crt 44 API calls 13085->13087 13086->13085 13088 b21a6e 13087->13088 13089 b21ab4 13088->13089 13090 b21a74 13088->13090 13091 b21b17 WriteFile 13089->13091 13092 b21ac8 13089->13092 13093 b21a7b 13090->13093 13094 b21a9e 13090->13094 13097 b21b39 GetLastError 13091->13097 13091->13104 13095 b21ad0 13092->13095 13096 b21b05 13092->13096 13101 b214e2 ___scrt_uninitialize_crt 6 API calls 13093->13101 13093->13104 13098 b21110 ___scrt_uninitialize_crt 49 API calls 13094->13098 13099 b21af3 13095->13099 13100 b21ad5 13095->13100 13102 b215c8 ___scrt_uninitialize_crt 7 API calls 13096->13102 13097->13104 13098->13104 13103 b2178c ___scrt_uninitialize_crt 8 API calls 13099->13103 13100->13104 13105 b216a3 ___scrt_uninitialize_crt 7 API calls 13100->13105 13101->13104 13102->13104 13103->13104 13104->13076 13105->13104 13107 b1d7d2 ___scrt_uninitialize_crt LeaveCriticalSection 13106->13107 13108 b2198c 13107->13108 13108->13069 13110 b20ffd __FrameHandler3::FrameUnwindToState 13109->13110 13122 b1d7af EnterCriticalSection 13110->13122 13112 b2100c 13113 b21051 13112->13113 13123 b1d886 13112->13123 13115 b1bfa1 __dosmaperr 14 API calls 13113->13115 13117 b21058 13115->13117 13116 b21038 FlushFileBuffers 13116->13117 13118 b21044 GetLastError 13116->13118 13139 b21087 13117->13139 13136 b1bf8e 13118->13136 13122->13112 13124 b1d893 13123->13124 13128 b1d8a8 13123->13128 13125 b1bf8e __dosmaperr 14 API calls 13124->13125 13127 b1d898 13125->13127 13126 b1bf8e __dosmaperr 14 API calls 13129 b1d8d8 13126->13129 13130 b1bfa1 __dosmaperr 14 API calls 13127->13130 13128->13126 13131 b1d8cd 13128->13131 13132 b1bfa1 __dosmaperr 14 API calls 13129->13132 13133 b1d8a0 13130->13133 13131->13116 13134 b1d8e0 13132->13134 13133->13116 13135 b1bec0 ___std_exception_copy 43 API calls 13134->13135 13135->13133 13137 b1bb01 __dosmaperr 14 API calls 13136->13137 13138 b1bf93 13137->13138 13138->13113 13140 b1d7d2 ___scrt_uninitialize_crt LeaveCriticalSection 13139->13140 13141 b21070 13140->13141 13141->13067 13142->13043 13143->13026 13166 b1e99d 13167 b1e9c5 13166->13167 13168 b1e9aa 13166->13168 13170 b1e9d4 13167->13170 13187 b20f55 13167->13187 13168->13167 13169 b1e9b6 13168->13169 13171 b1bfa1 __dosmaperr 14 API calls 13169->13171 13175 b20f88 13170->13175 13174 b1e9bb CallUnexpected 13171->13174 13176 b20fa0 13175->13176 13177 b20f95 13175->13177 13179 b20fa8 13176->13179 13185 b20fb1 _unexpected 13176->13185 13178 b1dd8c 15 API calls 13177->13178 13183 b20f9d 13178->13183 13180 b1c011 __freea 14 API calls 13179->13180 13180->13183 13181 b20fb6 13184 b1bfa1 __dosmaperr 14 API calls 13181->13184 13182 b20fdb RtlReAllocateHeap 13182->13183 13182->13185 13183->13174 13184->13183 13185->13181 13185->13182 13186 b1eacd _unexpected 2 API calls 13185->13186 13186->13185 13188 b20f60 13187->13188 13189 b20f75 HeapSize 13187->13189 13190 b1bfa1 __dosmaperr 14 API calls 13188->13190 13189->13170 13191 b20f65 13190->13191 13192 b1bec0 ___std_exception_copy 43 API calls 13191->13192 13193 b20f70 13192->13193 13193->13170 14223 b1ea1c 14224 b1ea35 14223->14224 14225 b1ea53 14223->14225 14224->14225 14226 b1da6c 48 API calls 14224->14226 14226->14224 14268 b1b877 14269 b1b882 14268->14269 14270 b1b892 14268->14270 14274 b1b898 14269->14274 14273 b1c011 __freea 14 API calls 14273->14270 14275 b1b8b3 14274->14275 14276 b1b8ad 14274->14276 14278 b1c011 __freea 14 API calls 14275->14278 14277 b1c011 __freea 14 API calls 14276->14277 14277->14275 14279 b1b8bf 14278->14279 14280 b1c011 __freea 14 API calls 14279->14280 14281 b1b8ca 14280->14281 14282 b1c011 __freea 14 API calls 14281->14282 14283 b1b8d5 14282->14283 14284 b1c011 __freea 14 API calls 14283->14284 14285 b1b8e0 14284->14285 14286 b1c011 __freea 14 API calls 14285->14286 14287 b1b8eb 14286->14287 14288 b1c011 __freea 14 API calls 14287->14288 14289 b1b8f6 14288->14289 14290 b1c011 __freea 14 API calls 14289->14290 14291 b1b901 14290->14291 14292 b1c011 __freea 14 API calls 14291->14292 14293 b1b90c 14292->14293 14294 b1c011 __freea 14 API calls 14293->14294 14295 b1b91a 14294->14295 14300 b1b6c4 14295->14300 14301 b1b6d0 __FrameHandler3::FrameUnwindToState 14300->14301 14316 b1d5d1 EnterCriticalSection 14301->14316 14303 b1b6da 14306 b1c011 __freea 14 API calls 14303->14306 14307 b1b704 14303->14307 14306->14307 14317 b1b723 14307->14317 14308 b1b72f 14309 b1b73b __FrameHandler3::FrameUnwindToState 14308->14309 14321 b1d5d1 EnterCriticalSection 14309->14321 14311 b1b745 14312 b1b965 _unexpected 14 API calls 14311->14312 14313 b1b758 14312->14313 14322 b1b778 14313->14322 14316->14303 14320 b1d619 LeaveCriticalSection 14317->14320 14319 b1b711 14319->14308 14320->14319 14321->14311 14325 b1d619 LeaveCriticalSection 14322->14325 14324 b1b766 14324->14273 14325->14324 13617 b189d1 13620 b18936 13617->13620 13621 b18942 __FrameHandler3::FrameUnwindToState 13620->13621 13628 b1d5d1 EnterCriticalSection 13621->13628 13623 b1894c 13624 b1897a 13623->13624 13627 b1e525 ___scrt_uninitialize_crt 14 API calls 13623->13627 13629 b18998 13624->13629 13627->13623 13628->13623 13632 b1d619 LeaveCriticalSection 13629->13632 13631 b18986 13632->13631 13686 b1f1d8 13687 b1f107 ___scrt_uninitialize_crt 72 API calls 13686->13687 13688 b1f1e0 13687->13688 13696 b21bc6 13688->13696 13690 b1f1e5 13706 b21c71 13690->13706 13693 b1f20f 13694 b1c011 __freea 14 API calls 13693->13694 13695 b1f21a 13694->13695 13697 b21bd2 __FrameHandler3::FrameUnwindToState 13696->13697 13710 b1d5d1 EnterCriticalSection 13697->13710 13699 b21c49 13717 b21c68 13699->13717 13702 b21c1d DeleteCriticalSection 13703 b1c011 __freea 14 API calls 13702->13703 13705 b21bdd 13703->13705 13705->13699 13705->13702 13711 b23d09 13705->13711 13707 b21c88 13706->13707 13708 b1f1f4 DeleteCriticalSection 13706->13708 13707->13708 13709 b1c011 __freea 14 API calls 13707->13709 13708->13690 13708->13693 13709->13708 13710->13705 13712 b23d1c ___std_exception_copy 13711->13712 13720 b23be4 13712->13720 13714 b23d28 13715 b1a270 ___std_exception_copy 43 API calls 13714->13715 13716 b23d34 13715->13716 13716->13705 13792 b1d619 LeaveCriticalSection 13717->13792 13719 b21c55 13719->13690 13721 b23bf0 __FrameHandler3::FrameUnwindToState 13720->13721 13722 b23bfa 13721->13722 13723 b23c1d 13721->13723 13724 b1be43 ___std_exception_copy 43 API calls 13722->13724 13730 b23c15 13723->13730 13731 b1f224 EnterCriticalSection 13723->13731 13724->13730 13726 b23c3b 13732 b23c7b 13726->13732 13728 b23c48 13746 b23c73 13728->13746 13730->13714 13731->13726 13733 b23cab 13732->13733 13734 b23c88 13732->13734 13736 b1f039 ___scrt_uninitialize_crt 68 API calls 13733->13736 13744 b23ca3 13733->13744 13735 b1be43 ___std_exception_copy 43 API calls 13734->13735 13735->13744 13737 b23cc3 13736->13737 13738 b21c71 14 API calls 13737->13738 13739 b23ccb 13738->13739 13740 b204a9 ___scrt_uninitialize_crt 43 API calls 13739->13740 13741 b23cd7 13740->13741 13749 b2493c 13741->13749 13744->13728 13745 b1c011 __freea 14 API calls 13745->13744 13791 b1f238 LeaveCriticalSection 13746->13791 13748 b23c79 13748->13730 13750 b24965 13749->13750 13755 b23cde 13749->13755 13751 b249b4 13750->13751 13753 b2498c 13750->13753 13752 b1be43 ___std_exception_copy 43 API calls 13751->13752 13752->13755 13756 b248ab 13753->13756 13755->13744 13755->13745 13757 b248b7 __FrameHandler3::FrameUnwindToState 13756->13757 13764 b1d7af EnterCriticalSection 13757->13764 13759 b248c5 13760 b248f6 13759->13760 13765 b249df 13759->13765 13778 b24930 13760->13778 13764->13759 13766 b1d886 ___scrt_uninitialize_crt 43 API calls 13765->13766 13769 b249ef 13766->13769 13767 b249f5 13781 b1d7f5 13767->13781 13769->13767 13771 b1d886 ___scrt_uninitialize_crt 43 API calls 13769->13771 13777 b24a27 13769->13777 13770 b1d886 ___scrt_uninitialize_crt 43 API calls 13772 b24a33 CloseHandle 13770->13772 13773 b24a1e 13771->13773 13772->13767 13774 b24a3f GetLastError 13772->13774 13775 b1d886 ___scrt_uninitialize_crt 43 API calls 13773->13775 13774->13767 13775->13777 13776 b24a4d ___scrt_uninitialize_crt 13776->13760 13777->13767 13777->13770 13790 b1d7d2 LeaveCriticalSection 13778->13790 13780 b24919 13780->13755 13782 b1d804 13781->13782 13783 b1d86b 13781->13783 13782->13783 13788 b1d82e 13782->13788 13784 b1bfa1 __dosmaperr 14 API calls 13783->13784 13785 b1d870 13784->13785 13786 b1bf8e __dosmaperr 14 API calls 13785->13786 13787 b1d85b 13786->13787 13787->13776 13788->13787 13789 b1d855 SetStdHandle 13788->13789 13789->13787 13790->13780 13791->13748 13792->13719

                                                                                                                                                                Executed Functions

                                                                                                                                                                Function 00B11ECD Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97fileCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                • GetTempFileNameW.KERNELBASE(?,GUT,00000000,?), ref: 00B11F0F
                                                                                                                                                                • FindResourceW.KERNEL32(00000000,00000066,00B2DA38,?,?), ref: 00B11F51
                                                                                                                                                                • LoadResource.KERNEL32(00000000,00000000), ref: 00B11F60
                                                                                                                                                                • LockResource.KERNEL32(00000000), ref: 00B11F6B
                                                                                                                                                                • CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000004,00000000,00000000), ref: 00B11F8B
                                                                                                                                                                • SizeofResource.KERNEL32(00000000,00000000,00000000), ref: 00B11F9D
                                                                                                                                                                • SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000), ref: 00B11FB6
                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 00B11FC1
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Resource$File$CloseCreateFindHandleLoadLockNamePointerSizeofTemp
                                                                                                                                                                • String ID: GUT
                                                                                                                                                                • API String ID: 3559219628-559840939
                                                                                                                                                                • Opcode ID: 8030ae90108dcabf08cea7ec7cedd6ebd63b3a7d52324610aadf401ab1612c2f
                                                                                                                                                                • Instruction ID: d97bccfe6def1e6c0f395c491c7814b6a97e2d8988346568d26bf65f8816c706
                                                                                                                                                                • Opcode Fuzzy Hash: 8030ae90108dcabf08cea7ec7cedd6ebd63b3a7d52324610aadf401ab1612c2f
                                                                                                                                                                • Instruction Fuzzy Hash: 2F21B9B16012196FE720AB749C89FFB73ECEB24351F4005A5F915E31D0EF309D8A86A0
                                                                                                                                                                Function 00B124AD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 196 b124ad-b124cc GetModuleHandleW GetProcAddress 197 b124d5-b124e5 CoInitializeEx 196->197 198 b124ce 196->198 199 b124f7-b12500 call b123f7 197->199 200 b124e7-b124f0 call b113a0 197->200 198->197 207 b12522-b12525 call b12699 199->207 205 b12502-b1251d call b11887 call b1193f call b118ca 200->205 206 b124f2 200->206 205->207 206->199 210 b1252a-b1252e 207->210
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories), ref: 00B124BD
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000), ref: 00B124C4
                                                                                                                                                                • CoInitializeEx.OLE32(00000000,00000002), ref: 00B124DA
                                                                                                                                                                  • Part of subcall function 00B118CA: DeleteFileW.KERNELBASE(00000000,00000000,?,00000000,?,00B12522), ref: 00B118EC
                                                                                                                                                                  • Part of subcall function 00B118CA: RemoveDirectoryW.KERNELBASE(?,?,00000000,?,00B12522), ref: 00B11904
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressDeleteDirectoryFileHandleInitializeModuleProcRemove
                                                                                                                                                                • String ID: SetDefaultDllDirectories$kernel32.dll
                                                                                                                                                                • API String ID: 2684526300-2102062458
                                                                                                                                                                • Opcode ID: 7e27b82c1cdead2e082a8bbf07fd6748edf40da8d89405012a28c133f4bf587c
                                                                                                                                                                • Instruction ID: 81cc826e36ce0a83f1f2a3f2be8ca63f3fb3c114904f3e34a3989e4aaffc4393
                                                                                                                                                                • Opcode Fuzzy Hash: 7e27b82c1cdead2e082a8bbf07fd6748edf40da8d89405012a28c133f4bf587c
                                                                                                                                                                • Instruction Fuzzy Hash: 3301A231A04205ABDB14BBB4AC1AADD7AE49F18391F804894FA02E71D1EE70C9919661
                                                                                                                                                                Function 00B13157 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 195fileCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                • ReadFile.KERNELBASE(?,?,00000200,?,00000000,?,?,?,?,00B13144,00000000,00000000,?,?,00B119D3), ref: 00B13199
                                                                                                                                                                • CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000100,00000000,?,00B2DBD0), ref: 00B132E3
                                                                                                                                                                • SetFilePointer.KERNELBASE(?,00000000,00000000,00000001), ref: 00B13317
                                                                                                                                                                • ReadFile.KERNELBASE(?,?,00040000,?,00000000), ref: 00B1335F
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$Read$CreatePointer
                                                                                                                                                                • String ID: NUL$ustar
                                                                                                                                                                • API String ID: 4132024448-732201731
                                                                                                                                                                • Opcode ID: 558c625e4bab0a9341f715f8e8f24bed01cdce2611f5cbc6f5ca38cafbae06ee
                                                                                                                                                                • Instruction ID: 2cebfeb522f35c42adccfec5cad18aa5081f8f9e4b615946fe2484a51eccf5d2
                                                                                                                                                                • Opcode Fuzzy Hash: 558c625e4bab0a9341f715f8e8f24bed01cdce2611f5cbc6f5ca38cafbae06ee
                                                                                                                                                                • Instruction Fuzzy Hash: DB7183F194112D9FDB209F50DD89AEAB7F8EF04700F4001E9A619B71D0EBB05B858F58
                                                                                                                                                                Function 00B1193F Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 168COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00B11DD4: IsUserAnAdmin.SHELL32 ref: 00B11DDD
                                                                                                                                                                • PathQuoteSpacesW.SHLWAPI(00000000,00000104), ref: 00B11A27
                                                                                                                                                                • GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 00B11A58
                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 00B11B4B
                                                                                                                                                                  • Part of subcall function 00B11E56: GetTempPathW.KERNEL32(00000104,00000000,00000104,?,?,?,00B1196E), ref: 00B11E85
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Path$AdminCloseFileHandleModuleNameQuoteSpacesTempUser
                                                                                                                                                                • String ID: "%s"$ %s$ /%s %s /%s$install$installsource$taggedmi
                                                                                                                                                                • API String ID: 2276683166-1343157288
                                                                                                                                                                • Opcode ID: 9cb3ba8970486b55fc7bf6ed85e257ac49820c918b17d462727468682c36591a
                                                                                                                                                                • Instruction ID: 199d346720337fd61a0fb746341e2fb99cc9590e081cddf4408877b636641436
                                                                                                                                                                • Opcode Fuzzy Hash: 9cb3ba8970486b55fc7bf6ed85e257ac49820c918b17d462727468682c36591a
                                                                                                                                                                • Instruction Fuzzy Hash: 0951E7715083009BCB14EF28D896EEBB3D9EF91310F904DADF95997191EB30D989CB52
                                                                                                                                                                Function 00B1347D Relevance: 10.6, APIs: 7, Instructions: 84processsynchronizationCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                • GetStartupInfoW.KERNEL32(?,?,?,00000000), ref: 00B134B7
                                                                                                                                                                • CreateProcessW.KERNELBASE(00000000,00000010,00000000,00000000,00000000,00000400,00000000,00000000,?,?,?,?,00000000), ref: 00B134F2
                                                                                                                                                                • GetLastError.KERNEL32(?,?,00000000), ref: 00B134FC
                                                                                                                                                                • WaitForSingleObject.KERNEL32(?,000000FF,?,?,00000000), ref: 00B1350E
                                                                                                                                                                • GetExitCodeProcess.KERNELBASE(?,?), ref: 00B1351F
                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,00000000), ref: 00B13538
                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,00000000), ref: 00B1353D
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseHandleProcess$CodeCreateErrorExitInfoLastObjectSingleStartupWait
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2373000011-0
                                                                                                                                                                • Opcode ID: 72569bb9fc744f9d14699540e4a25b9acc488241652f920fb268ccaae41a4171
                                                                                                                                                                • Instruction ID: 78ac75027f2d5bebc93a521470391b16ac4d0ecb8894aaaf54f623c302b4723b
                                                                                                                                                                • Opcode Fuzzy Hash: 72569bb9fc744f9d14699540e4a25b9acc488241652f920fb268ccaae41a4171
                                                                                                                                                                • Instruction Fuzzy Hash: 5E213D7190121DEFEB109FB4DC86DEFBBBDEF04754B504465A611A3160EA309E46DB50
                                                                                                                                                                Function 00B11D2B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59fileCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 177 b11d2b-b11d46 CreateDirectoryW 178 b11d59-b11d95 call b1283a call b12861 GetTempFileNameW call b12588 177->178 179 b11d48-b11d53 GetLastError 177->179 188 b11dc4-b11dcc call b12bb8 178->188 189 b11d97-b11d9a 178->189 179->178 180 b11d55-b11d57 179->180 182 b11dce-b11dd1 180->182 188->182 189->188 191 b11d9c-b11db1 DeleteFileW CreateDirectoryW 189->191 191->188 192 b11db3-b11dc2 call b1272a 191->192 192->188
                                                                                                                                                                APIs
                                                                                                                                                                • CreateDirectoryW.KERNELBASE(?,00000000,?,00000000,?,?,?,?,00B11963), ref: 00B11D3E
                                                                                                                                                                • GetLastError.KERNEL32(?,00000000,?,?,?,?,00B11963), ref: 00B11D48
                                                                                                                                                                • GetTempFileNameW.KERNELBASE(?,GUM,00000000,00000000,00000104,?,00000000,?), ref: 00B11D83
                                                                                                                                                                • DeleteFileW.KERNELBASE(000000FF,?,00000000,?), ref: 00B11D9F
                                                                                                                                                                • CreateDirectoryW.KERNELBASE(000000FF,00000000,?,00000000,?), ref: 00B11DA9
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateDirectoryFile$DeleteErrorLastNameTemp
                                                                                                                                                                • String ID: GUM
                                                                                                                                                                • API String ID: 55127950-1161156203
                                                                                                                                                                • Opcode ID: 4f1ba02d53f80d21fd319b7492620527f5857f3ea90595962a2b45c6abd0630e
                                                                                                                                                                • Instruction ID: d617464d95b302944eae84e95eb83b1c9811d1182c55ed6cf36878fbfed61155
                                                                                                                                                                • Opcode Fuzzy Hash: 4f1ba02d53f80d21fd319b7492620527f5857f3ea90595962a2b45c6abd0630e
                                                                                                                                                                • Instruction Fuzzy Hash: E0118F75500109AFCF04AF68DC899ED7BF9EF15381B9448A8F505971A0EF309EA6DB50
                                                                                                                                                                Function 00B12FE1 Relevance: 7.6, APIs: 5, Instructions: 64fileCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 215 b12fe1-b13011 call b13079 CreateFileW 218 b13071 215->218 219 b13013-b13025 CreateFileMappingW 215->219 220 b13073-b13076 218->220 221 b13027-b1303a MapViewOfFile 219->221 222 b1306a-b1306c call b13079 219->222 224 b13061-b13064 CloseHandle 221->224 225 b1303c-b13055 VirtualQuery 221->225 222->218 224->222 225->224 226 b13057-b1305f 225->226 226->220
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00B13079: UnmapViewOfFile.KERNEL32(00000000,00B2DBCC,00B12FF0,?,?,?,?,?,?,00B11593), ref: 00B13085
                                                                                                                                                                  • Part of subcall function 00B13079: CloseHandle.KERNEL32(004C554E,00B2DBCC,00B12FF0,?,?,?,?,?,?,00B11593), ref: 00B13098
                                                                                                                                                                  • Part of subcall function 00B13079: CloseHandle.KERNEL32(0000005C,00B2DBCC,00B12FF0,?,?,?,?,?,?,00B11593), ref: 00B130AB
                                                                                                                                                                • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,?,?,?,?,00B11593), ref: 00B13005
                                                                                                                                                                • CreateFileMappingW.KERNELBASE(00000000,00000000,00000002,00000000,00000000,00000000,?,?,?,?,?,?,00B11593), ref: 00B1301A
                                                                                                                                                                • MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000000,?,?,?,?,?,?,00B11593), ref: 00B1302D
                                                                                                                                                                • VirtualQuery.KERNEL32(00000000,?,0000001C,?,?,?,?,?,?,00B11593), ref: 00B1304D
                                                                                                                                                                • CloseHandle.KERNEL32(004C554E,?,?,?,?,?,?,00B11593), ref: 00B13064
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$CloseHandle$CreateView$MappingQueryUnmapVirtual
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1729669285-0
                                                                                                                                                                • Opcode ID: e9ce135c5e105dd26f68d4ae6fdf31a0bc0576fd6fb35803494114e492a5d9ad
                                                                                                                                                                • Instruction ID: c7b56083b1a5bea8199186955b5f55d338ec212a9d6dce327d792313d936f576
                                                                                                                                                                • Opcode Fuzzy Hash: e9ce135c5e105dd26f68d4ae6fdf31a0bc0576fd6fb35803494114e492a5d9ad
                                                                                                                                                                • Instruction Fuzzy Hash: 2F117070600341BADB345B269C0DF9B7AF9EBC9F10F00851DB552A61D1EE709592C660
                                                                                                                                                                Function 00B11B68 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 227 b11b68-b11ba5 call b1283a call b114da 231 b11baa-b11bb8 227->231 232 b11bba 231->232 233 b11bbc-b11bc2 231->233 232->233 234 b11bc4-b11bd5 call b12bd3 233->234 235 b11bd7-b11bef call b129fe call b12a75 233->235 240 b11bf5-b11c0d call b27c07 call b12bb8 234->240 235->240 247 b11c5b-b11c74 call b12bb8 call b15a02 240->247 248 b11c0f-b11c3b call b15f10 GetModuleFileNameW 240->248 248->247 253 b11c3d-b11c3f 248->253 253->247 255 b11c41-b11c58 call b114da 253->255 255->247
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,00000000,00000000,00000000,00000000), ref: 00B11C33
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileModuleName
                                                                                                                                                                • String ID: "%s"$/%s$recover
                                                                                                                                                                • API String ID: 514040917-4067204065
                                                                                                                                                                • Opcode ID: 9d62e7cef329a4eb36a24c40397603238ec4ab65b5e6e2b49c5491104723b548
                                                                                                                                                                • Instruction ID: 35e91373a7e131cf041a830074d4fc42841fefbeea0e4f717347532150b57b4d
                                                                                                                                                                • Opcode Fuzzy Hash: 9d62e7cef329a4eb36a24c40397603238ec4ab65b5e6e2b49c5491104723b548
                                                                                                                                                                • Instruction Fuzzy Hash: 4A218771A4011C9BDF24EB24DC86ADEB7F8EF24314F9045E5E919E7281DA709EC4CAA0
                                                                                                                                                                Function 00B11C77 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 70stringCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 259 b11c77-b11ca4 call b1283a call b114da 264 b11ca6 259->264 265 b11ca8-b11cb5 259->265 264->265 266 b11cc7-b11ce3 call b129fe call b12a75 265->266 267 b11cb7-b11cc5 call b12bd3 265->267 272 b11ce6-b11cfa lstrcmpiW call b12bb8 266->272 267->272 277 b11d18 272->277 278 b11cfc-b11d16 call b12861 call b12ad6 272->278 279 b11d1a-b11d28 call b12bb8 277->279 278->279
                                                                                                                                                                APIs
                                                                                                                                                                • lstrcmpiW.KERNELBASE(?,?,00000000,00000000,00000000,00B11AEB,?,?,?,?,00000104), ref: 00B11CE8
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: lstrcmpi
                                                                                                                                                                • String ID: /%s$nomitag
                                                                                                                                                                • API String ID: 1586166983-2458505853
                                                                                                                                                                • Opcode ID: 87bc7ede8fb7b7313af429f5a323270ad01a7702638d0642c0d91240a0f9bc61
                                                                                                                                                                • Instruction ID: d2b3c3a2b5d67de5099887015d8525bc38250b8d3e1297fb7a771f00b2b87648
                                                                                                                                                                • Opcode Fuzzy Hash: 87bc7ede8fb7b7313af429f5a323270ad01a7702638d0642c0d91240a0f9bc61
                                                                                                                                                                • Instruction Fuzzy Hash: 5211D336600118AFCB04EFADD895CDEB7E8EF9535079044ADF9069B351EE30EA95CB90
                                                                                                                                                                Function 00B187A5 Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                • GetCurrentProcess.KERNEL32(00B188B8,?,00B1879F,00000000,?,?,00B188B8,501CDF8A,?,00B188B8), ref: 00B187B6
                                                                                                                                                                • TerminateProcess.KERNEL32(00000000,?,00B1879F,00000000,?,?,00B188B8,501CDF8A,?,00B188B8), ref: 00B187BD
                                                                                                                                                                • ExitProcess.KERNEL32 ref: 00B187CF
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Process$CurrentExitTerminate
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1703294689-0
                                                                                                                                                                • Opcode ID: 5b5b43a3145e435fd0b784518179929a54b189d60ff1d0c4b10e58b2437fae0f
                                                                                                                                                                • Instruction ID: 0d94498fab04bc0a92b34c9591ac115bd1b447eaad5b21c1896f0114d45e5b6c
                                                                                                                                                                • Opcode Fuzzy Hash: 5b5b43a3145e435fd0b784518179929a54b189d60ff1d0c4b10e58b2437fae0f
                                                                                                                                                                • Instruction Fuzzy Hash: 0FD09231402108ABDF213F61EC0DD9A3FAAFF44391BA44050F9199B0B1CF759E9ADA95
                                                                                                                                                                Function 00B12075 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 145COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 293 b12075-b1209f call b127db call b1260c 298 b120a1-b120a3 293->298 299 b120a5-b120ab call b1ddda 293->299 301 b120ac-b120b2 298->301 299->301 303 b120bc-b120be 301->303 304 b120c0-b120c3 303->304 305 b120b4-b120b7 303->305 306 b120c5-b120c7 304->306 308 b12118-b12123 call b12bd3 304->308 305->306 307 b120b9 305->307 306->308 310 b120c9-b120cd 306->310 307->303 313 b12126-b1213b call b12861 308->313 310->308 312 b120cf-b120d9 310->312 314 b120db 312->314 315 b120dd-b120e6 312->315 324 b12141-b1215d CharLowerBuffW call b12ad6 313->324 325 b121d9 313->325 314->315 317 b1216d-b12172 315->317 318 b120ec-b120f1 315->318 319 b121de-b121ed call b1103b call b12075 317->319 321 b120f3-b120f5 318->321 322 b120f7-b120f9 318->322 335 b121f2-b121f5 319->335 321->322 326 b120fb 322->326 327 b120fd-b12116 call b129fe call b12a75 322->327 336 b121c2-b121d6 call b12bb8 * 2 324->336 337 b1215f-b1216b 324->337 325->319 326->327 327->313 337->317 340 b12174-b12176 337->340 342 b12178 340->342 343 b1217a-b121a1 call b129fe call b12a75 call b27c07 340->343 342->343 352 b121a3-b121af 343->352 353 b121ba-b121bd call b12bb8 343->353 352->353 354 b121b1-b121b5 call b1272a 352->354 353->336 354->353
                                                                                                                                                                APIs
                                                                                                                                                                • CharLowerBuffW.USER32(00000000,?,?,?,?), ref: 00B12143
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: BuffCharLower
                                                                                                                                                                • String ID: .exe
                                                                                                                                                                • API String ID: 2358735015-4119554291
                                                                                                                                                                • Opcode ID: 1105b04a18de21d6dd629be6f43ea927b071e128db43df703223a97353991b38
                                                                                                                                                                • Instruction ID: 3f04ad955ca2a6169d9459a016ce92cfe550aab9855ddd31f261827947402f85
                                                                                                                                                                • Opcode Fuzzy Hash: 1105b04a18de21d6dd629be6f43ea927b071e128db43df703223a97353991b38
                                                                                                                                                                • Instruction Fuzzy Hash: F641CF36500108EFCB24EF64D9858EE77E9EF54350B9046A9F906E7191EF30AEE4CB50
                                                                                                                                                                Function 00B11FDD Relevance: 3.1, APIs: 2, Instructions: 56fileCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,00000104,?,00000000), ref: 00B1200F
                                                                                                                                                                  • Part of subcall function 00B12531: PathAppendW.SHLWAPI(00000000,AVGBrowserUpdateSetup.exe,00000104,00000000,?,00B1203F,?,?,?,00000000), ref: 00B12545
                                                                                                                                                                • CopyFileW.KERNELBASE(?,?,00000000,?,?,?,00000000), ref: 00B12046
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$AppendCopyModuleNamePath
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1240757089-0
                                                                                                                                                                • Opcode ID: a4d83968dc580c9f1bb198e1601090dba2b65be9763c890328a39e86b7ca9f0b
                                                                                                                                                                • Instruction ID: ab9393ae7f602449a32cc3b00360dff72f38816fbbbfeaa57383b263edb7cc43
                                                                                                                                                                • Opcode Fuzzy Hash: a4d83968dc580c9f1bb198e1601090dba2b65be9763c890328a39e86b7ca9f0b
                                                                                                                                                                • Instruction Fuzzy Hash: 8F113C75900209AFDF14EFA4CD958EEB7B9AF14310B9006E9E412A2291EF705F99DB60
                                                                                                                                                                Function 00B11DD4 Relevance: 3.1, APIs: 2, Instructions: 52COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 378 b11dd4-b11de5 IsUserAnAdmin 379 b11de7-b11de9 378->379 380 b11deb-b11e28 call b1283a call b12861 SHGetFolderPathW call b12588 378->380 381 b11e53-b11e55 379->381 388 b11e47-b11e52 call b12bb8 380->388 389 b11e2a-b11e30 call b11d2b 380->389 388->381 392 b11e35-b11e37 389->392 392->388 394 b11e39-b11e45 call b1272a 392->394 394->388
                                                                                                                                                                APIs
                                                                                                                                                                • IsUserAnAdmin.SHELL32 ref: 00B11DDD
                                                                                                                                                                • SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,00000000,00000104,?,?,?,00B11963), ref: 00B11E16
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AdminFolderPathUser
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2137563717-0
                                                                                                                                                                • Opcode ID: 5b6b027448670d4332b5ad0e485fe089f16e4af1f300006a0bd4f2f967ad8850
                                                                                                                                                                • Instruction ID: bf9e682e6dc5989bd20581185146017eab9d0af1b8de71e9cb24ea4c7df5e5dd
                                                                                                                                                                • Opcode Fuzzy Hash: 5b6b027448670d4332b5ad0e485fe089f16e4af1f300006a0bd4f2f967ad8850
                                                                                                                                                                • Instruction Fuzzy Hash: 2301B576900208BBDF10EBB4DD869EEB3FCEE05354B9009E5E901E3181EB709F45C650
                                                                                                                                                                Function 00B118CA Relevance: 3.0, APIs: 2, Instructions: 40fileCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 397 b118ca-b118d9 398 b11913 397->398 399 b118db-b118e0 397->399 402 b11916-b11939 call b12bb8 * 2 call b125d3 call b12bb8 398->402 400 b118e2-b118f6 call b125ae DeleteFileW 399->400 401 b118f8-b1190c call b125d3 RemoveDirectoryW call b1289d 399->401 400->401 412 b11911 401->412 412->402
                                                                                                                                                                APIs
                                                                                                                                                                • DeleteFileW.KERNELBASE(00000000,00000000,?,00000000,?,00B12522), ref: 00B118EC
                                                                                                                                                                • RemoveDirectoryW.KERNELBASE(?,?,00000000,?,00B12522), ref: 00B11904
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: DeleteDirectoryFileRemove
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3325800564-0
                                                                                                                                                                • Opcode ID: 0d2c8534a609c0f20be25e4e9a6f938ebe42f233c0073eb4556733b4929fb266
                                                                                                                                                                • Instruction ID: d7f065953cabcb962518a1fcf2d3db67fd4962946bb72b1243bcb25f8246626a
                                                                                                                                                                • Opcode Fuzzy Hash: 0d2c8534a609c0f20be25e4e9a6f938ebe42f233c0073eb4556733b4929fb266
                                                                                                                                                                • Instruction Fuzzy Hash: 33F046322006018F8A35AF24C9A14FAB3F6FE9435038049BDA08363551DF2069AA9B50
                                                                                                                                                                Function 00B1C011 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 417 b1c011-b1c01a 418 b1c049-b1c04a 417->418 419 b1c01c-b1c02f RtlFreeHeap 417->419 419->418 420 b1c031-b1c048 GetLastError call b1bf04 call b1bfa1 419->420 420->418
                                                                                                                                                                APIs
                                                                                                                                                                • RtlFreeHeap.NTDLL(00000000,00000000,?,00B1DC78,?,00000000,?,?,00B1DC9D,?,00000007,?,?,00B1E3EF,?,?), ref: 00B1C027
                                                                                                                                                                • GetLastError.KERNEL32(?,?,00B1DC78,?,00000000,?,?,00B1DC9D,?,00000007,?,?,00B1E3EF,?,?), ref: 00B1C032
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorFreeHeapLast
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 485612231-0
                                                                                                                                                                • Opcode ID: 9571f3c9acd3d671f1ba16c6a2949fc54a6851a8d2d631fccdc7c91f6abdfaee
                                                                                                                                                                • Instruction ID: baf0b89d1e85b510c0ba586e7ef8b91b151636d384fca62556c53833a71517f0
                                                                                                                                                                • Opcode Fuzzy Hash: 9571f3c9acd3d671f1ba16c6a2949fc54a6851a8d2d631fccdc7c91f6abdfaee
                                                                                                                                                                • Instruction Fuzzy Hash: 57E0EC32141214ABCB212BA9AC0DBDA3BADEB48791F5540A0F60897060DF3889D6CBD8
                                                                                                                                                                Function 00B12A1D Relevance: 2.5, APIs: 2, Instructions: 39COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,000000FF,00000000,00000000,?,?,?,00B127C9,?,?,?,00B1189D,?), ref: 00B12A36
                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,000000FF,00000000,-00000001,-00000001,?,?,?,00B127C9,?,?,?,00B1189D,?), ref: 00B12A56
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ByteCharMultiWide
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 626452242-0
                                                                                                                                                                • Opcode ID: 6d7df237b83012b075b919cb196e69637c6294576df518ed0cb5b741f18abaf3
                                                                                                                                                                • Instruction ID: b919c74ba9fbf5f2340f4f54e0806b324d3dfbce462462dda0fee980a14f8554
                                                                                                                                                                • Opcode Fuzzy Hash: 6d7df237b83012b075b919cb196e69637c6294576df518ed0cb5b741f18abaf3
                                                                                                                                                                • Instruction Fuzzy Hash: 62F0E9313045147EDA211B495C05FFFB69DDF90F60F500159B924D61F0CE704A9142A5
                                                                                                                                                                Function 00B12212 Relevance: 1.7, APIs: 1, Instructions: 164COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: bb951c4d80354ae8a3f404168f134ad92539f928db325c93817010d43956dfde
                                                                                                                                                                • Instruction ID: 124a30f56e8a997098e2812a44de46cb8f8dad6d10dfdb560863c875a1275e7c
                                                                                                                                                                • Opcode Fuzzy Hash: bb951c4d80354ae8a3f404168f134ad92539f928db325c93817010d43956dfde
                                                                                                                                                                • Instruction Fuzzy Hash: 7B51F771D002289FDB24DF68DC80AEEBBF8FB49314F5041AEE51DE7241EA7099958F54
                                                                                                                                                                Function 00B20F88 Relevance: 1.5, APIs: 1, Instructions: 44memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00B1DD8C: RtlAllocateHeap.NTDLL(00000000,00000000,00B18DD6,?,00B20F9D,00B114EA,00000000,?,00B1E9E6,00000000,00B18DD6,00000004,?,00000000,?,00B18BD0), ref: 00B1DDBE
                                                                                                                                                                • RtlReAllocateHeap.NTDLL(00000000,00000000,00B114EA,00B18DD6,00000000,?,00B1E9E6,00000000,00B18DD6,00000004,?,00000000,?,00B18BD0,?,00000004), ref: 00B20FE5
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocateHeap
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1279760036-0
                                                                                                                                                                • Opcode ID: 3d3069534297dfe33446e51d02028e6ef2773e00372427d60d9175a4010f5d57
                                                                                                                                                                • Instruction ID: 688818d1538767349e8644140496e7a8804b6c187d962940a85e92aa1dd24879
                                                                                                                                                                • Opcode Fuzzy Hash: 3d3069534297dfe33446e51d02028e6ef2773e00372427d60d9175a4010f5d57
                                                                                                                                                                • Instruction Fuzzy Hash: 3AF0C8312A5220AA8B317A25BD41F9B77D8DF917B0F510195FC1897092DE30D8415690
                                                                                                                                                                Function 00B1BFB4 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RtlAllocateHeap.NTDLL(00000008,00B114EA,00B114EA,?,00B1BB4E,00000001,00000364,00B114EA,00000006,000000FF,?,00B1E9E6,00000000,00B18DD6,00000004), ref: 00B1BFF5
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocateHeap
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1279760036-0
                                                                                                                                                                • Opcode ID: 14f0bdea3b06c90ad344b2d8b94856a541028c3c4890862ab139871ceef14a62
                                                                                                                                                                • Instruction ID: 954e2dc5d2cdf7c363af88f2702c68a945ad534b608ad4472bed0129d998fb10
                                                                                                                                                                • Opcode Fuzzy Hash: 14f0bdea3b06c90ad344b2d8b94856a541028c3c4890862ab139871ceef14a62
                                                                                                                                                                • Instruction Fuzzy Hash: 73F0E931251220A79B616A629C15FDB3BD9EF457A0F9640E1FC14D7190CF30DCD28AE0
                                                                                                                                                                Function 00B1DD8C Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RtlAllocateHeap.NTDLL(00000000,00000000,00B18DD6,?,00B20F9D,00B114EA,00000000,?,00B1E9E6,00000000,00B18DD6,00000004,?,00000000,?,00B18BD0), ref: 00B1DDBE
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocateHeap
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1279760036-0
                                                                                                                                                                • Opcode ID: 41611bf6996143cdfc8b9df7c2be0f9b8db219143d247b3758b90fd6672ac4df
                                                                                                                                                                • Instruction ID: f4e44ce71f3cfc62fac43749c014a20ef5f4b37216266d1e5ed8c030176be64e
                                                                                                                                                                • Opcode Fuzzy Hash: 41611bf6996143cdfc8b9df7c2be0f9b8db219143d247b3758b90fd6672ac4df
                                                                                                                                                                • Instruction Fuzzy Hash: C3E06D21201220ABEB212676BC00BDB76DCEF527A1FD612F5AD15971D5CF60DCC185E5
                                                                                                                                                                Function 00B130F1 Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • DeleteFileW.KERNELBASE(00000000,00000000,?,00000000,?,00B11B4A), ref: 00B13108
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: DeleteFile
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4033686569-0
                                                                                                                                                                • Opcode ID: 5a5b4a633cfe2ec3e1fdc6824e8a9efc597db0678094ce42bb86563e6e2cc21d
                                                                                                                                                                • Instruction ID: d233395f148a49c5557edeb4921d09f95c6790792c4e94c6b87c5a190ef58414
                                                                                                                                                                • Opcode Fuzzy Hash: 5a5b4a633cfe2ec3e1fdc6824e8a9efc597db0678094ce42bb86563e6e2cc21d
                                                                                                                                                                • Instruction Fuzzy Hash: C6E048311005009F8335AF14DC918E7B3F6FF9075139006BED453524619F606ED6DB90
                                                                                                                                                                Function 00B11168 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: e2775a040f5471359ca97c9f06d418f23b3522fc4ffadf37359c38e42532fd0c
                                                                                                                                                                • Instruction ID: 4905b59d19b6f11b5a470c05de7651d0b6eb7d08ef65ffd0ad729ebf9d898ddb
                                                                                                                                                                • Opcode Fuzzy Hash: e2775a040f5471359ca97c9f06d418f23b3522fc4ffadf37359c38e42532fd0c
                                                                                                                                                                • Instruction Fuzzy Hash: B6E0ED31200208FFDB105F54DC84FA67BB5FF54715F64C494F6169A120C731D9659B50
                                                                                                                                                                Function 00B1114D Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RtlFreeHeap.NTDLL(?,00000000,00000000), ref: 00B1115E
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FreeHeap
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3298025750-0
                                                                                                                                                                • Opcode ID: 404f5fc939d484c963bb0a694f673654504ec401b9659114e31df4705ccc57ec
                                                                                                                                                                • Instruction ID: 4bba69082a0f35fdd35ae0022dd0972847b83866f4637f1e8c29efc99189e233
                                                                                                                                                                • Opcode Fuzzy Hash: 404f5fc939d484c963bb0a694f673654504ec401b9659114e31df4705ccc57ec
                                                                                                                                                                • Instruction Fuzzy Hash: 4CC01231040208BACB110A44DC09BD6BAA9AB00704F548020B708184A0CBB294B1DA84
                                                                                                                                                                Function 00B11138 Relevance: 1.5, APIs: 1, Instructions: 8memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RtlAllocateHeap.NTDLL(?,00000000,?), ref: 00B11143
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocateHeap
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1279760036-0
                                                                                                                                                                • Opcode ID: 5eef2100e44d95bbc83c8f9222664dd5c4f8ead3b76082e12a39de0381c43357
                                                                                                                                                                • Instruction ID: 99b181d85bed2f4278d6499c46ca8daadfa128dfa213481598399e0b955397a9
                                                                                                                                                                • Opcode Fuzzy Hash: 5eef2100e44d95bbc83c8f9222664dd5c4f8ead3b76082e12a39de0381c43357
                                                                                                                                                                • Instruction Fuzzy Hash: 92B09232041208FBDA111B81EC06F86BF29EB15750F14C021F6084A0628B73A462AAA8

                                                                                                                                                                Non-executed Functions

                                                                                                                                                                Function 00B22438 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: __floor_pentium4
                                                                                                                                                                • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                • API String ID: 4168288129-2761157908
                                                                                                                                                                • Opcode ID: 289068a43510bdb5e27d30de9f3249d87476b7972d5c8a5f709a3ecda1f68a44
                                                                                                                                                                • Instruction ID: 0cd76decd7dfe92ff7bebb3437b3fd08ca34ba94f803cdb010719f823bb7a931
                                                                                                                                                                • Opcode Fuzzy Hash: 289068a43510bdb5e27d30de9f3249d87476b7972d5c8a5f709a3ecda1f68a44
                                                                                                                                                                • Instruction Fuzzy Hash: 2ED20771E086299BDB65CF28ED807EAB7F5EB44304F1445EAD44DE7240EB78AE818F41
                                                                                                                                                                Function 00B12E59 Relevance: 9.1, APIs: 6, Instructions: 113windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetLastError.KERNEL32(00005288,80040750,?,00005288), ref: 00B12E71
                                                                                                                                                                • SetLastError.KERNEL32(00000000,?,00005288), ref: 00B12E7E
                                                                                                                                                                • FormatMessageW.KERNEL32(00000500,00000000,00000000,00000000,00000000,00000000,00005288,?,00005288), ref: 00B12E94
                                                                                                                                                                • GetLastError.KERNEL32(?,00005288), ref: 00B12E9E
                                                                                                                                                                • SetLastError.KERNEL32(00005288,?,00005288), ref: 00B12EAB
                                                                                                                                                                • LocalFree.KERNEL32(00000000,?,00005288), ref: 00B12F57
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLast$FormatFreeLocalMessage
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2740663437-0
                                                                                                                                                                • Opcode ID: 09afef9dba46ab3f599f0d7eeb16a6287dd88abba8f6eafb87bd994e12170af6
                                                                                                                                                                • Instruction ID: aa6dd8fb286182353de39545e8b004419c3a24240b46dbcf7ab50826d153f1bb
                                                                                                                                                                • Opcode Fuzzy Hash: 09afef9dba46ab3f599f0d7eeb16a6287dd88abba8f6eafb87bd994e12170af6
                                                                                                                                                                • Instruction Fuzzy Hash: 7531E832A00204AFDF14AF64DC85EEEB7F9EF94700FA041E9F90197191DB71AD928B64
                                                                                                                                                                Function 00B1557C Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00B15588
                                                                                                                                                                • IsDebuggerPresent.KERNEL32 ref: 00B15654
                                                                                                                                                                • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00B15674
                                                                                                                                                                • UnhandledExceptionFilter.KERNEL32(?), ref: 00B1567E
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 254469556-0
                                                                                                                                                                • Opcode ID: d8e33cb01864b6fd57747e211381c995971dc54058c50378b4020a2a788c5bc6
                                                                                                                                                                • Instruction ID: 476b51d85187b08bfe3f44485a4d35683f19dd7a70017a8d34f320e6a6d30ebe
                                                                                                                                                                • Opcode Fuzzy Hash: d8e33cb01864b6fd57747e211381c995971dc54058c50378b4020a2a788c5bc6
                                                                                                                                                                • Instruction Fuzzy Hash: 28312775D01218DBDB21DFA4D989BCDBBF8BF08304F5040EAE40CAB250EB709A899F45
                                                                                                                                                                Function 00B1F931 Relevance: 4.8, APIs: 3, Instructions: 337COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: f64376321c9e7733dab5e32c209a512f5feed5745fd6e3734d147e349a30b006
                                                                                                                                                                • Instruction ID: 0357bfc5bcf875ba8795d35517664be64eddb26cbd8f62004f980edc09ad61ed
                                                                                                                                                                • Opcode Fuzzy Hash: f64376321c9e7733dab5e32c209a512f5feed5745fd6e3734d147e349a30b006
                                                                                                                                                                • Instruction Fuzzy Hash: ECB159729042479FDB158F68C891BFEBBF5EF59340F5481F9E905AB241D2389D82C7A0
                                                                                                                                                                Function 00B1BCC4 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00B1BDBC
                                                                                                                                                                • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00B1BDC6
                                                                                                                                                                • UnhandledExceptionFilter.KERNEL32(00B111C2,?,?,?,?,?,00000000), ref: 00B1BDD3
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3906539128-0
                                                                                                                                                                • Opcode ID: 2450538ec5b24620f8bb82c530262306de187f33107e444162253948471e6802
                                                                                                                                                                • Instruction ID: 050517438e1d497f734668354954508e8490a1e22f3481d16949f58a9689b829
                                                                                                                                                                • Opcode Fuzzy Hash: 2450538ec5b24620f8bb82c530262306de187f33107e444162253948471e6802
                                                                                                                                                                • Instruction Fuzzy Hash: 5E31927491121CDBCB21DF68D989BCDBBF8AF48310F5041EAE41CA7251EB709B858F55
                                                                                                                                                                Function 00B111D5 Relevance: 4.6, APIs: 3, Instructions: 53memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetProcessHeap.KERNEL32(?,?,00B12842,?,00B114EA), ref: 00B11218
                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 00B1123F
                                                                                                                                                                  • Part of subcall function 00B26965: EnterCriticalSection.KERNEL32(00B313A0,00B313D0,?,?,00B1120E,00B313D0,?,?,00B12842,?,00B114EA), ref: 00B26970
                                                                                                                                                                  • Part of subcall function 00B26965: LeaveCriticalSection.KERNEL32(00B313A0,?,00B1120E,00B313D0,?,?,00B12842,?,00B114EA), ref: 00B269AD
                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 00B112A1
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CriticalInit_thread_footerSection$EnterHeapLeaveProcess
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3363689876-0
                                                                                                                                                                • Opcode ID: 167f6105bdd57755d22b271460a157e2737a54601e7470b46eccea8180a10147
                                                                                                                                                                • Instruction ID: 8c88c67498d98c47b35bdf0389662cd006630389ea6f8ec57b0ba6f46b47a6b1
                                                                                                                                                                • Opcode Fuzzy Hash: 167f6105bdd57755d22b271460a157e2737a54601e7470b46eccea8180a10147
                                                                                                                                                                • Instruction Fuzzy Hash: 2F116A72505710AAC310DBADBC89BDD33E8E745B61F300DEDE21897AA0CFB414898B5C
                                                                                                                                                                Function 00B21FB0 Relevance: 3.4, APIs: 2, Instructions: 449COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 8c2167c69fa0775cc169345ec03e10a36e3dc4825b97ef4f9a7d9d1deaf14d74
                                                                                                                                                                • Instruction ID: 99e43642ceb3e69ca170f5426c0ce4aa3b203bf2c238fa93f9a49f3dc5e08f38
                                                                                                                                                                • Opcode Fuzzy Hash: 8c2167c69fa0775cc169345ec03e10a36e3dc4825b97ef4f9a7d9d1deaf14d74
                                                                                                                                                                • Instruction Fuzzy Hash: 21F12D71E002299FDF14CFA9D880AADB7F1FF88314F1582A9E919E7354D7319A41CB94
                                                                                                                                                                Function 00B25CAB Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RaiseException.KERNEL32(C000000D,00000000,00000001,000000FF,?,00000008,?,?,00B25CA6,000000FF,?,00000008,?,?,00B258B0,00000000), ref: 00B25ED8
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExceptionRaise
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3997070919-0
                                                                                                                                                                • Opcode ID: 2c48fede1d0308b682849bdb834fae288fdf7e0a22499f1bbd42285d56f442cb
                                                                                                                                                                • Instruction ID: e0df39373147d2f01d88f56b1b9c3f53604e8f4a421914498a656b05d8f7ee53
                                                                                                                                                                • Opcode Fuzzy Hash: 2c48fede1d0308b682849bdb834fae288fdf7e0a22499f1bbd42285d56f442cb
                                                                                                                                                                • Instruction Fuzzy Hash: 2CB15E31610A18DFD724CF28D58AB657BE0FF45364F258698E89DCF2A1C335E992CB40
                                                                                                                                                                Function 00B15825 Relevance: 1.6, APIs: 1, Instructions: 144COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00B1583B
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FeaturePresentProcessor
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2325560087-0
                                                                                                                                                                • Opcode ID: b42ecb47fdc3410afcc013d84c6fe704271b1dae9c61207e106e73990a039510
                                                                                                                                                                • Instruction ID: ea5f61cde70bedada53e51058ed22e734afff7b68f71540919b49976bee37a72
                                                                                                                                                                • Opcode Fuzzy Hash: b42ecb47fdc3410afcc013d84c6fe704271b1dae9c61207e106e73990a039510
                                                                                                                                                                • Instruction Fuzzy Hash: 2551A1B1A15A09CFEB28CF59D9917AEBBF0FF88310F24856AC415EB351D7749980CB50
                                                                                                                                                                Function 00B1C375 Relevance: 1.6, APIs: 1, Instructions: 140COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 53f1d3b872b26479eb55fedb681b54345cfb5bd5abd6e80ea6e177808b25c495
                                                                                                                                                                • Instruction ID: 4b15e2fa928d4ec6b9d6b7e8d5242c9f8c0e7c3761c306ebf39e1fe785a0468f
                                                                                                                                                                • Opcode Fuzzy Hash: 53f1d3b872b26479eb55fedb681b54345cfb5bd5abd6e80ea6e177808b25c495
                                                                                                                                                                • Instruction Fuzzy Hash: 7841BEB584422CAEDB20DF79CC89AEABBF9EF45300F5442D9E41CE3241DA359E858F50
                                                                                                                                                                Function 00B1A8D4 Relevance: 1.6, Strings: 1, Instructions: 388COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID: 0
                                                                                                                                                                • API String ID: 0-4108050209
                                                                                                                                                                • Opcode ID: 035212e43df6e72897454205483e9537d2afe9ce1a70773f44a213f7177807c1
                                                                                                                                                                • Instruction ID: bdaee2a86038f37f1e9c5646e0312ed7dd90a39e9b96aac61bbb58ec2aa9455c
                                                                                                                                                                • Opcode Fuzzy Hash: 035212e43df6e72897454205483e9537d2afe9ce1a70773f44a213f7177807c1
                                                                                                                                                                • Instruction Fuzzy Hash: 1CE199706026058FCB24DF68C590AEEB7F1FF49310FA44699D4569B2A1D730BDC6CB52
                                                                                                                                                                Function 00B15710 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SetUnhandledExceptionFilter.KERNEL32(Function_0000571C,00B15088), ref: 00B15715
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExceptionFilterUnhandled
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3192549508-0
                                                                                                                                                                • Opcode ID: 9f30230780345191b9d57fbff78ca6444a79035e1964f470509e6833da7412b3
                                                                                                                                                                • Instruction ID: a71c88c0964dec5878b2c6b5e57863e8ab7109fd01d76066bbb6cb3998e29fe4
                                                                                                                                                                • Opcode Fuzzy Hash: 9f30230780345191b9d57fbff78ca6444a79035e1964f470509e6833da7412b3
                                                                                                                                                                • Instruction Fuzzy Hash:
                                                                                                                                                                Function 00B1432C Relevance: .5, Instructions: 502COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 07742bc48a47d668c5b7ba0a761fa324f4e69b4b27f22652eb96e8f34f5a8860
                                                                                                                                                                • Instruction ID: 049a16de4318e88f1f4ad26b992d37e857599d96ff7a27c37df4a93f063560da
                                                                                                                                                                • Opcode Fuzzy Hash: 07742bc48a47d668c5b7ba0a761fa324f4e69b4b27f22652eb96e8f34f5a8860
                                                                                                                                                                • Instruction Fuzzy Hash: 97027F72E0016A8FDF14CB79C4806BCBBF2EB85385F5546B5E456EB284E7749AC1CB80
                                                                                                                                                                Function 00B1D630 Relevance: .0, Instructions: 22COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 16ebe579c643b41b3b2ed50db8f55ad19555c0db4d7538cbefb163680043b31e
                                                                                                                                                                • Instruction ID: 36114af01be83e77b6239a98954d2ac7aeee8f0853edb53417ad32cd33071a7c
                                                                                                                                                                • Opcode Fuzzy Hash: 16ebe579c643b41b3b2ed50db8f55ad19555c0db4d7538cbefb163680043b31e
                                                                                                                                                                • Instruction Fuzzy Hash: 50E08C72A11228EBCB24DB88C90498AF3ECEB46B40B510096B505D3100C270DE80C7D0
                                                                                                                                                                Function 00B187D6 Relevance: .0, Instructions: 12COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 7da01f73916667ee9dce2ec342e5fd9c37d59bb777700199a5176be3c2df7822
                                                                                                                                                                • Instruction ID: a2d62f8555a0a2d8cc3287d9372f9ada6407db8f94bdf3a00dd27032fbc4cccd
                                                                                                                                                                • Opcode Fuzzy Hash: 7da01f73916667ee9dce2ec342e5fd9c37d59bb777700199a5176be3c2df7822
                                                                                                                                                                • Instruction Fuzzy Hash: 00C08C3800198086CE29CE28C271BE533E4F392782FE004CCD41A0B782DD1E9CC6DA00
                                                                                                                                                                Function 00B2687D Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • InitializeCriticalSectionAndSpinCount.KERNEL32(00B313A0,00000FA0,?,?,00B2685B), ref: 00B26889
                                                                                                                                                                • GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00B2685B), ref: 00B26894
                                                                                                                                                                • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00B2685B), ref: 00B268A5
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00B268B7
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00B268C5
                                                                                                                                                                • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00B2685B), ref: 00B268E8
                                                                                                                                                                • DeleteCriticalSection.KERNEL32(00B313A0,00000007,?,?,00B2685B), ref: 00B26904
                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?,?,00B2685B), ref: 00B26914
                                                                                                                                                                Strings
                                                                                                                                                                • WakeAllConditionVariable, xrefs: 00B268BD
                                                                                                                                                                • kernel32.dll, xrefs: 00B268A0
                                                                                                                                                                • api-ms-win-core-synch-l1-2-0.dll, xrefs: 00B2688F
                                                                                                                                                                • SleepConditionVariableCS, xrefs: 00B268B1
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
                                                                                                                                                                • String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                                                                                                                                • API String ID: 2565136772-3242537097
                                                                                                                                                                • Opcode ID: bf35da47bedd58b7a15a3612d13dd09f9600710cd751e5fef8b3383bd5916d96
                                                                                                                                                                • Instruction ID: 30366169eee26424f6491c8f9e19ed16026567b3047b1fbbf3112f48935734ed
                                                                                                                                                                • Opcode Fuzzy Hash: bf35da47bedd58b7a15a3612d13dd09f9600710cd751e5fef8b3383bd5916d96
                                                                                                                                                                • Instruction Fuzzy Hash: 5B017135A46731BBD7311B75BC0DA6B3ADCEB44B51B1044A1F90DDB664DE70CC058A64
                                                                                                                                                                Function 00B1715B Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • IsInExceptionSpec.LIBVCRUNTIME ref: 00B17258
                                                                                                                                                                • type_info::operator==.LIBVCRUNTIME ref: 00B1727A
                                                                                                                                                                • ___TypeMatch.LIBVCRUNTIME ref: 00B17389
                                                                                                                                                                • IsInExceptionSpec.LIBVCRUNTIME ref: 00B1745B
                                                                                                                                                                • _UnwindNestedFrames.LIBCMT ref: 00B174DF
                                                                                                                                                                • CallUnexpected.LIBVCRUNTIME ref: 00B174FA
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
                                                                                                                                                                • String ID: csm$csm$csm
                                                                                                                                                                • API String ID: 2123188842-393685449
                                                                                                                                                                • Opcode ID: ac2767b134d945591ed5bf50e0891d296869dc4278110f9a2404c4464749b479
                                                                                                                                                                • Instruction ID: af852ea3532c1c1c0fa844445153576a40cf203bcb1118ee14281bac2b661933
                                                                                                                                                                • Opcode Fuzzy Hash: ac2767b134d945591ed5bf50e0891d296869dc4278110f9a2404c4464749b479
                                                                                                                                                                • Instruction Fuzzy Hash: F8B14971C48219AFCF25DFA4D8819EEBBF5FF09310B9441A9E8146B212DB31DA91CBD1
                                                                                                                                                                Function 00B15B80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • _ValidateLocalCookies.LIBCMT ref: 00B15BB7
                                                                                                                                                                • ___except_validate_context_record.LIBVCRUNTIME ref: 00B15BBF
                                                                                                                                                                • _ValidateLocalCookies.LIBCMT ref: 00B15C48
                                                                                                                                                                • __IsNonwritableInCurrentImage.LIBCMT ref: 00B15C73
                                                                                                                                                                • _ValidateLocalCookies.LIBCMT ref: 00B15CC8
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                                                                • String ID: csm
                                                                                                                                                                • API String ID: 1170836740-1018135373
                                                                                                                                                                • Opcode ID: 01399a78aa21127a0baf3953d8876837e50458676e6f8ef9ce5ccd37b9f28b31
                                                                                                                                                                • Instruction ID: b36865458e7cd5787601a260187a4f467b0102a04a3bc574059f98bbde0160e0
                                                                                                                                                                • Opcode Fuzzy Hash: 01399a78aa21127a0baf3953d8876837e50458676e6f8ef9ce5ccd37b9f28b31
                                                                                                                                                                • Instruction Fuzzy Hash: 44418434A00618EBCF24DF69C884ADEBBF5EF85314F5481D5E814AB352D731AA95CBD0
                                                                                                                                                                Function 00B1E5C3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • FreeLibrary.KERNEL32(00000000,?,00B1E6D0,00B18DD6,0000000C,00B114EA,00000000,00000000,?,00B1E849,00000021,FlsSetValue,00B2A0F0,00B2A0F8,00B114EA), ref: 00B1E684
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FreeLibrary
                                                                                                                                                                • String ID: api-ms-$ext-ms-
                                                                                                                                                                • API String ID: 3664257935-537541572
                                                                                                                                                                • Opcode ID: 966a2b1acdbcf7d9c4227793c94dbcf1f3a24c0d69ff6d7f892dfb28c595385e
                                                                                                                                                                • Instruction ID: 97d887029b51d10c22f4df25c2288a9c3d2352057046e6060fd9d8052fd2d1a1
                                                                                                                                                                • Opcode Fuzzy Hash: 966a2b1acdbcf7d9c4227793c94dbcf1f3a24c0d69ff6d7f892dfb28c595385e
                                                                                                                                                                • Instruction Fuzzy Hash: F521DD71A02220ABCB319B64DC44EDB77D8EF65770FA50690ED29A7290DF30ED85CAD0
                                                                                                                                                                Function 00B16231 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetLastError.KERNEL32(?,?,00B16228,00B15EFC,00B15760), ref: 00B1623F
                                                                                                                                                                • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00B1624D
                                                                                                                                                                • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00B16266
                                                                                                                                                                • SetLastError.KERNEL32(00000000,00B16228,00B15EFC,00B15760), ref: 00B162B8
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLastValue___vcrt_
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3852720340-0
                                                                                                                                                                • Opcode ID: b8ee7a4e87083e6e87fa7cc11ee6190bce037ad74e60980e3b288a1615099f1d
                                                                                                                                                                • Instruction ID: a434b3e5dacec36653333d7f597825b508b84b98b77a68fb86bd0fff6eb9c0c6
                                                                                                                                                                • Opcode Fuzzy Hash: b8ee7a4e87083e6e87fa7cc11ee6190bce037ad74e60980e3b288a1615099f1d
                                                                                                                                                                • Instruction Fuzzy Hash: 150124336193155EEA2A36746C96BFA27E9EF253B0B7002A9F520820F1EF314CC15184
                                                                                                                                                                Function 00B1C900 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Strings
                                                                                                                                                                • C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe, xrefs: 00B1C91C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID: C:\Users\user\AppData\Local\Temp\nswF1F4.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                                                                • API String ID: 0-848388443
                                                                                                                                                                • Opcode ID: b194f9c276cc08d654aa73c4788d9681e29eb0dd1357d6a0266c1a2389b6b804
                                                                                                                                                                • Instruction ID: 2ce4edce5a3868fac9c199be36657b15a3b3dbd6a805d33e6a5ad901f38a84d5
                                                                                                                                                                • Opcode Fuzzy Hash: b194f9c276cc08d654aa73c4788d9681e29eb0dd1357d6a0266c1a2389b6b804
                                                                                                                                                                • Instruction Fuzzy Hash: B1216D72240205BF9B22AF718C81EEA7BE9EF443E479145A5F829D7151DB30ED818BA1
                                                                                                                                                                Function 00B163B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • FreeLibrary.KERNEL32(00000000,?,?,?,00B16474,?,?,00B30CD0,00000000,?,00B1659F,00000004,InitializeCriticalSectionEx,00B28CB4,InitializeCriticalSectionEx,00000000), ref: 00B16443
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FreeLibrary
                                                                                                                                                                • String ID: api-ms-
                                                                                                                                                                • API String ID: 3664257935-2084034818
                                                                                                                                                                • Opcode ID: 97816c2d55081efff3a6982182a6e09b7283c16f171454ff059c4b3f9cbbb65c
                                                                                                                                                                • Instruction ID: ade1bed82fb958d31e9486574e65dc17bab29c5b6e67dd152be8af3f0545a3e2
                                                                                                                                                                • Opcode Fuzzy Hash: 97816c2d55081efff3a6982182a6e09b7283c16f171454ff059c4b3f9cbbb65c
                                                                                                                                                                • Instruction Fuzzy Hash: 8E11C632A42235ABCF324B68AC45B9A37E4DF05770F640194E914E7380DB70ED858AD5
                                                                                                                                                                Function 00B187F8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,501CDF8A,?,?,00000000,00B27D5C,000000FF,?,00B187CB,00B188B8,?,00B1879F,00000000), ref: 00B1882D
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00B1883F
                                                                                                                                                                • FreeLibrary.KERNEL32(00000000,?,?,00000000,00B27D5C,000000FF,?,00B187CB,00B188B8,?,00B1879F,00000000), ref: 00B18861
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                • API String ID: 4061214504-1276376045
                                                                                                                                                                • Opcode ID: e1facec89dedebe7f7ee6e9e76ebb255f7d47436620524961244d87aa07bd902
                                                                                                                                                                • Instruction ID: 06d57610a0555bea4e287a1018aacd8c81534c25f5f0f68625c96788efe6f877
                                                                                                                                                                • Opcode Fuzzy Hash: e1facec89dedebe7f7ee6e9e76ebb255f7d47436620524961244d87aa07bd902
                                                                                                                                                                • Instruction Fuzzy Hash: 4301A231951669AFDB219B40DC09BAFBBF8FB04B11F000679E815A22E0DF749904CA80
                                                                                                                                                                Function 00B20C44 Relevance: 7.7, APIs: 5, Instructions: 202COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __alloca_probe_16.LIBCMT ref: 00B20CCB
                                                                                                                                                                • __alloca_probe_16.LIBCMT ref: 00B20D8C
                                                                                                                                                                • __freea.LIBCMT ref: 00B20DF3
                                                                                                                                                                  • Part of subcall function 00B1DD8C: RtlAllocateHeap.NTDLL(00000000,00000000,00B18DD6,?,00B20F9D,00B114EA,00000000,?,00B1E9E6,00000000,00B18DD6,00000004,?,00000000,?,00B18BD0), ref: 00B1DDBE
                                                                                                                                                                • __freea.LIBCMT ref: 00B20E08
                                                                                                                                                                • __freea.LIBCMT ref: 00B20E18
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: __freea$__alloca_probe_16$AllocateHeap
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1423051803-0
                                                                                                                                                                • Opcode ID: 4469f446424c18e73ab8cb5d28694c0bef6386d6c0d30edad452674c84a48d36
                                                                                                                                                                • Instruction ID: 55c0bda63453a5c61efa0825b95200d7a04af150c020f0246e0d04715ded219e
                                                                                                                                                                • Opcode Fuzzy Hash: 4469f446424c18e73ab8cb5d28694c0bef6386d6c0d30edad452674c84a48d36
                                                                                                                                                                • Instruction Fuzzy Hash: DD51B672A20126AFDB21BE64EC85DFB76E9EF44754B1505A8FC0CD6152E730DC5087A0
                                                                                                                                                                Function 00B21110 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetConsoleOutputCP.KERNEL32(501CDF8A,?,00000000,00B2E6E0), ref: 00B21173
                                                                                                                                                                  • Part of subcall function 00B1D402: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00B20DE9,?,00000000,-00000008), ref: 00B1D4AE
                                                                                                                                                                • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00B213CE
                                                                                                                                                                • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00B21416
                                                                                                                                                                • GetLastError.KERNEL32 ref: 00B214B9
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2112829910-0
                                                                                                                                                                • Opcode ID: d27040054684d3574534f8d7dd6e201e180a3c0b52f39b546d60c49edd69e61b
                                                                                                                                                                • Instruction ID: 861dc804d847ff83cbe6d49e31dcda1570a73e7f7907edff3f6f747c0cf5d9ad
                                                                                                                                                                • Opcode Fuzzy Hash: d27040054684d3574534f8d7dd6e201e180a3c0b52f39b546d60c49edd69e61b
                                                                                                                                                                • Instruction Fuzzy Hash: 8AD15A75D002689FCB15DFA8E8809ADBBF5FF19300F18496AE869E7351D630A946CF50
                                                                                                                                                                Function 00B16F04 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AdjustPointer
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1740715915-0
                                                                                                                                                                • Opcode ID: 7a9da9f3a756d7817bfd066990c3e4d9333bbd1976aa17c509ae8130834bd23c
                                                                                                                                                                • Instruction ID: d7c30e7ae9845f48cfdc75e5034d224e646907f1fd3e8693324b17bbda920ed2
                                                                                                                                                                • Opcode Fuzzy Hash: 7a9da9f3a756d7817bfd066990c3e4d9333bbd1976aa17c509ae8130834bd23c
                                                                                                                                                                • Instruction Fuzzy Hash: AD518C72649702EFDB298F15D885BEA77F4EF48310F9445ADE805872A1EB31ADC1CA90
                                                                                                                                                                Function 00B1C115 Relevance: 6.1, APIs: 4, Instructions: 82COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00B1D402: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00B20DE9,?,00000000,-00000008), ref: 00B1D4AE
                                                                                                                                                                • GetLastError.KERNEL32 ref: 00B1C179
                                                                                                                                                                • __dosmaperr.LIBCMT ref: 00B1C180
                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,?), ref: 00B1C1BA
                                                                                                                                                                • __dosmaperr.LIBCMT ref: 00B1C1C1
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLast__dosmaperr$ByteCharMultiWide
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1913693674-0
                                                                                                                                                                • Opcode ID: cdcdc392b9aed56bc6ceaecf506fa830116e26bfceaa9694d8de5f20510a5cd5
                                                                                                                                                                • Instruction ID: 1467474c1b7dfd3168ee549c07224fd7cced234db98cdac0f690444991a97bb3
                                                                                                                                                                • Opcode Fuzzy Hash: cdcdc392b9aed56bc6ceaecf506fa830116e26bfceaa9694d8de5f20510a5cd5
                                                                                                                                                                • Instruction Fuzzy Hash: D42171716C0205BF9B20AF61CC859FABBE9FF443A47904599F919E7642DB30EC918B90
                                                                                                                                                                Function 00B1D4F0 Relevance: 6.1, APIs: 4, Instructions: 74COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetEnvironmentStringsW.KERNEL32 ref: 00B1D4F8
                                                                                                                                                                  • Part of subcall function 00B1D402: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00B20DE9,?,00000000,-00000008), ref: 00B1D4AE
                                                                                                                                                                • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00B1D530
                                                                                                                                                                • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00B1D550
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: EnvironmentStrings$Free$ByteCharMultiWide
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 158306478-0
                                                                                                                                                                • Opcode ID: fe1454cc116f61afbacf00984c6a95c491eb628eb9ddfc22ac6da4538089e74b
                                                                                                                                                                • Instruction ID: 763dcbaebb597079413bed73bddcd75ee7f80d27affef3933e52a243c04a23a9
                                                                                                                                                                • Opcode Fuzzy Hash: fe1454cc116f61afbacf00984c6a95c491eb628eb9ddfc22ac6da4538089e74b
                                                                                                                                                                • Instruction Fuzzy Hash: BC11D6F1A01515BE67212BB65CCECFF6EEDDE693983A006A5F501D3141EE24DE8292B0
                                                                                                                                                                Function 00B113A0 Relevance: 6.1, APIs: 4, Instructions: 57COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003,00000020,00000003), ref: 00B113FF
                                                                                                                                                                • VerSetConditionMask.KERNEL32(00000000), ref: 00B11403
                                                                                                                                                                • VerSetConditionMask.KERNEL32(00000000), ref: 00B11407
                                                                                                                                                                • VerifyVersionInfoW.KERNEL32(0000011C,00000023,00000000), ref: 00B1142B
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ConditionMask$InfoVerifyVersion
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2793162063-0
                                                                                                                                                                • Opcode ID: 1096e891535ff162dcae5d74c49b718d7000cd5eb94f74727b6972509c8f5a0f
                                                                                                                                                                • Instruction ID: 032ab5f54cffa96c021cdb8ad48e01391e8c07cf47426b5833cca9d565ba2dcb
                                                                                                                                                                • Opcode Fuzzy Hash: 1096e891535ff162dcae5d74c49b718d7000cd5eb94f74727b6972509c8f5a0f
                                                                                                                                                                • Instruction Fuzzy Hash: 48113370A5031CBAEB319B559C4AFEFBBBCEF84B10F00449AA504A71C1DAB45B458E90
                                                                                                                                                                Function 00B24856 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • WriteConsoleW.KERNEL32(?,00B2E6E0,00000000,00000000,?,?,00B23BD0,?,00000001,?,00B2E6E0,?,00B2150D,00B2E6E0,?,00000000), ref: 00B2486D
                                                                                                                                                                • GetLastError.KERNEL32(?,00B23BD0,?,00000001,?,00B2E6E0,?,00B2150D,00B2E6E0,?,00000000,00B2E6E0,00B2E6E0,?,00B21A94,?), ref: 00B24879
                                                                                                                                                                  • Part of subcall function 00B2483F: CloseHandle.KERNEL32(FFFFFFFE,00B24889,?,00B23BD0,?,00000001,?,00B2E6E0,?,00B2150D,00B2E6E0,?,00000000,00B2E6E0,00B2E6E0), ref: 00B2484F
                                                                                                                                                                • ___initconout.LIBCMT ref: 00B24889
                                                                                                                                                                  • Part of subcall function 00B24801: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00B24830,00B23BBD,00B2E6E0,?,00B2150D,00B2E6E0,?,00000000,00B2E6E0), ref: 00B24814
                                                                                                                                                                • WriteConsoleW.KERNEL32(?,00B2E6E0,00000000,00000000,?,00B23BD0,?,00000001,?,00B2E6E0,?,00B2150D,00B2E6E0,?,00000000,00B2E6E0), ref: 00B2489E
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2744216297-0
                                                                                                                                                                • Opcode ID: b56dde2d592d4ee709577b870d48f76245ca861abd860189939fc6e2b5ff4ba2
                                                                                                                                                                • Instruction ID: 421194ca094e49c3e90056a80ac1abe3f6e98f1b881dd68c19bad906b9cba9ad
                                                                                                                                                                • Opcode Fuzzy Hash: b56dde2d592d4ee709577b870d48f76245ca861abd860189939fc6e2b5ff4ba2
                                                                                                                                                                • Instruction Fuzzy Hash: 80F0AC36521168BBCF226F95EC0599A3FA6FF087A1F154150FA1D9A520CF328821DB95
                                                                                                                                                                Function 00B269ED Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SleepConditionVariableCS.KERNELBASE(?,00B2698A,00000064), ref: 00B26A10
                                                                                                                                                                • LeaveCriticalSection.KERNEL32(00B313A0,?,?,00B2698A,00000064,?,00B1120E,00B313D0,?,?,00B12842,?,00B114EA), ref: 00B26A1A
                                                                                                                                                                • WaitForSingleObjectEx.KERNEL32(?,00000000,?,00B2698A,00000064,?,00B1120E,00B313D0,?,?,00B12842,?,00B114EA), ref: 00B26A2B
                                                                                                                                                                • EnterCriticalSection.KERNEL32(00B313A0,?,00B2698A,00000064,?,00B1120E,00B313D0,?,?,00B12842,?,00B114EA), ref: 00B26A32
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3269011525-0
                                                                                                                                                                • Opcode ID: ff301352516a6ec07a0dd2d887013c0bfd7daca889e34b30d17557e140bad004
                                                                                                                                                                • Instruction ID: fd9e288de412f49cbfafdfbf003099c0421e6bf0d9a8142c5baac7a2a04cbd35
                                                                                                                                                                • Opcode Fuzzy Hash: ff301352516a6ec07a0dd2d887013c0bfd7daca889e34b30d17557e140bad004
                                                                                                                                                                • Instruction Fuzzy Hash: 50E01236542224BBC7211F58EC09B9D3F5DEB0AB51B548490F90D77570CF6118129BD9
                                                                                                                                                                Function 00B17505 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00B1752A
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: EncodePointer
                                                                                                                                                                • String ID: MOC$RCC
                                                                                                                                                                • API String ID: 2118026453-2084237596
                                                                                                                                                                • Opcode ID: 2f7cc872783140573b3e5095bb78e41f224e95b620e7b28bef7600208f46fba7
                                                                                                                                                                • Instruction ID: b338cab198b0a366cba52a887b3ecaf1fb0ce93ca7b17e603ce63eb81ef78419
                                                                                                                                                                • Opcode Fuzzy Hash: 2f7cc872783140573b3e5095bb78e41f224e95b620e7b28bef7600208f46fba7
                                                                                                                                                                • Instruction Fuzzy Hash: 83414671900209AFCF15DF98C985AEEBBF6FF48304F588099F908A7251DB359A91DB90
                                                                                                                                                                Function 00B26271 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00B11097: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,8007000E,?,-C000001E,00000001), ref: 00B1109C
                                                                                                                                                                  • Part of subcall function 00B11097: GetLastError.KERNEL32(?,00000000,?,8007000E,?,-C000001E,00000001), ref: 00B110A6
                                                                                                                                                                • IsDebuggerPresent.KERNEL32(?,?,?,00B1100A), ref: 00B262A4
                                                                                                                                                                • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00B1100A), ref: 00B262B3
                                                                                                                                                                Strings
                                                                                                                                                                • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00B262AE
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.2908741246.0000000000B11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00B10000, based on PE: true
                                                                                                                                                                • Associated: 00000004.00000002.2908660026.0000000000B10000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908814795.0000000000B28000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908891448.0000000000B30000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                • Associated: 00000004.00000002.2908977251.0000000000B32000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_b10000_AVGBrowserUpdateSetup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
                                                                                                                                                                • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                                                                                                • API String ID: 450123788-631824599
                                                                                                                                                                • Opcode ID: cc7a638ef533fb8209486ac8d2ee0c3305afb869b59f89f7a3008211ebca88ca
                                                                                                                                                                • Instruction ID: a956fa94baf235bc7b33c521932af29ba07e5516fbbfb76833a3c84b356cc60c
                                                                                                                                                                • Opcode Fuzzy Hash: cc7a638ef533fb8209486ac8d2ee0c3305afb869b59f89f7a3008211ebca88ca
                                                                                                                                                                • Instruction Fuzzy Hash: 25E0ED716017608BD771EF68F8183467BE4AF09754F018D9DE449C3650EBB5D4888BA1

                                                                                                                                                                Execution Graph

                                                                                                                                                                Execution Coverage:3.1%
                                                                                                                                                                Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                Signature Coverage:0%
                                                                                                                                                                Total number of Nodes:1411
                                                                                                                                                                Total number of Limit Nodes:24
                                                                                                                                                                execution_graph 8490 a70da7 8493 a6e1be 8490->8493 8494 a6e1c7 8493->8494 8495 a6e1f9 8493->8495 8499 a6d2ab 8494->8499 8500 a6d2b6 8499->8500 8501 a6d2bc 8499->8501 8503 a6e8b3 _unexpected 6 API calls 8500->8503 8502 a6e8f2 _unexpected 6 API calls 8501->8502 8521 a6d2c2 8501->8521 8504 a6d2d6 8502->8504 8503->8501 8505 a6d682 _unexpected 14 API calls 8504->8505 8504->8521 8507 a6d2e6 8505->8507 8506 a6cce5 __FrameHandler3::FrameUnwindToState 41 API calls 8508 a6d340 8506->8508 8509 a6d303 8507->8509 8510 a6d2ee 8507->8510 8511 a6e8f2 _unexpected 6 API calls 8509->8511 8512 a6e8f2 _unexpected 6 API calls 8510->8512 8513 a6d30f 8511->8513 8519 a6d2fa 8512->8519 8514 a6d322 8513->8514 8515 a6d313 8513->8515 8517 a6d01e _unexpected 14 API calls 8514->8517 8516 a6e8f2 _unexpected 6 API calls 8515->8516 8516->8519 8520 a6d32d 8517->8520 8518 a6d4db ___free_lconv_mon 14 API calls 8518->8521 8519->8518 8522 a6d4db ___free_lconv_mon 14 API calls 8520->8522 8521->8506 8523 a6d2c7 8521->8523 8522->8523 8524 a6dfc9 8523->8524 8547 a6e11e 8524->8547 8530 a6e01d 8531 a6e025 8530->8531 8532 a6e033 8530->8532 8534 a6d4db ___free_lconv_mon 14 API calls 8531->8534 8572 a6e219 8532->8572 8536 a6e00c 8534->8536 8536->8495 8537 a6e06b 8538 a6baa8 ___free_lconv_mon 14 API calls 8537->8538 8539 a6e070 8538->8539 8542 a6d4db ___free_lconv_mon 14 API calls 8539->8542 8540 a6e0b2 8541 a6e0fb 8540->8541 8583 a6dc3b 8540->8583 8545 a6d4db ___free_lconv_mon 14 API calls 8541->8545 8542->8536 8543 a6e086 8543->8540 8546 a6d4db ___free_lconv_mon 14 API calls 8543->8546 8545->8536 8546->8540 8548 a6e12a __FrameHandler3::FrameUnwindToState 8547->8548 8549 a6e144 8548->8549 8591 a6d5f2 EnterCriticalSection 8548->8591 8552 a6dff3 8549->8552 8554 a6cce5 __FrameHandler3::FrameUnwindToState 41 API calls 8549->8554 8551 a6e180 8592 a6e19d 8551->8592 8558 a6dd49 8552->8558 8556 a6e1bd 8554->8556 8555 a6e154 8555->8551 8557 a6d4db ___free_lconv_mon 14 API calls 8555->8557 8557->8551 8596 a6dad9 8558->8596 8561 a6dd7c 8563 a6dd81 GetACP 8561->8563 8564 a6dd93 8561->8564 8562 a6dd6a GetOEMCP 8562->8564 8563->8564 8564->8536 8565 a6fa79 8564->8565 8566 a6fab7 8565->8566 8570 a6fa87 _unexpected 8565->8570 8567 a6baa8 ___free_lconv_mon 14 API calls 8566->8567 8569 a6fab5 8567->8569 8568 a6faa2 HeapAlloc 8568->8569 8568->8570 8569->8530 8570->8566 8570->8568 8571 a6ed0c _unexpected 2 API calls 8570->8571 8571->8570 8573 a6dd49 43 API calls 8572->8573 8574 a6e239 8573->8574 8576 a6e276 IsValidCodePage 8574->8576 8581 a6e2b2 __CreateFrameInfo 8574->8581 8575 a673a8 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 8577 a6e060 8575->8577 8578 a6e288 8576->8578 8576->8581 8577->8537 8577->8543 8579 a6e2b7 GetCPInfo 8578->8579 8582 a6e291 __CreateFrameInfo 8578->8582 8579->8581 8579->8582 8581->8575 8749 a6de1d 8582->8749 8584 a6dc47 __FrameHandler3::FrameUnwindToState 8583->8584 8833 a6d5f2 EnterCriticalSection 8584->8833 8586 a6dc51 8834 a6dc88 8586->8834 8591->8555 8595 a6d63a LeaveCriticalSection 8592->8595 8594 a6e1a4 8594->8549 8595->8594 8597 a6daf0 8596->8597 8598 a6daf9 8596->8598 8597->8561 8597->8562 8598->8597 8599 a6d1f0 _unexpected 41 API calls 8598->8599 8600 a6db19 8599->8600 8604 a7041e 8600->8604 8605 a70431 8604->8605 8606 a6db2f 8604->8606 8605->8606 8612 a6ff07 8605->8612 8608 a7047c 8606->8608 8609 a7048f 8608->8609 8611 a704a4 8608->8611 8609->8611 8744 a6e206 8609->8744 8611->8597 8613 a6ff13 __FrameHandler3::FrameUnwindToState 8612->8613 8614 a6d1f0 _unexpected 41 API calls 8613->8614 8615 a6ff1c 8614->8615 8622 a6ff62 8615->8622 8625 a6d5f2 EnterCriticalSection 8615->8625 8617 a6ff3a 8626 a6ff88 8617->8626 8622->8606 8623 a6cce5 __FrameHandler3::FrameUnwindToState 41 API calls 8624 a6ff87 8623->8624 8625->8617 8627 a6ff96 _unexpected 8626->8627 8629 a6ff4b 8626->8629 8627->8629 8633 a6fcbb 8627->8633 8630 a6ff67 8629->8630 8743 a6d63a LeaveCriticalSection 8630->8743 8632 a6ff5e 8632->8622 8632->8623 8634 a6fd3b 8633->8634 8637 a6fcd1 8633->8637 8635 a6fd89 8634->8635 8638 a6d4db ___free_lconv_mon 14 API calls 8634->8638 8701 a6fe2c 8635->8701 8637->8634 8639 a6fd04 8637->8639 8645 a6d4db ___free_lconv_mon 14 API calls 8637->8645 8640 a6fd5d 8638->8640 8641 a6fd26 8639->8641 8650 a6d4db ___free_lconv_mon 14 API calls 8639->8650 8642 a6d4db ___free_lconv_mon 14 API calls 8640->8642 8644 a6d4db ___free_lconv_mon 14 API calls 8641->8644 8646 a6fd70 8642->8646 8643 a6fd97 8648 a6fdf7 8643->8648 8657 a6d4db 14 API calls ___free_lconv_mon 8643->8657 8647 a6fd30 8644->8647 8649 a6fcf9 8645->8649 8651 a6d4db ___free_lconv_mon 14 API calls 8646->8651 8654 a6d4db ___free_lconv_mon 14 API calls 8647->8654 8655 a6d4db ___free_lconv_mon 14 API calls 8648->8655 8661 a6f809 8649->8661 8652 a6fd1b 8650->8652 8653 a6fd7e 8651->8653 8689 a6f907 8652->8689 8659 a6d4db ___free_lconv_mon 14 API calls 8653->8659 8654->8634 8660 a6fdfd 8655->8660 8657->8643 8659->8635 8660->8629 8662 a6f81a 8661->8662 8688 a6f903 8661->8688 8663 a6d4db ___free_lconv_mon 14 API calls 8662->8663 8666 a6f82b 8662->8666 8663->8666 8664 a6f84f 8669 a6f861 8664->8669 8670 a6d4db ___free_lconv_mon 14 API calls 8664->8670 8665 a6f83d 8665->8664 8668 a6d4db ___free_lconv_mon 14 API calls 8665->8668 8666->8665 8667 a6d4db ___free_lconv_mon 14 API calls 8666->8667 8667->8665 8668->8664 8671 a6f873 8669->8671 8672 a6d4db ___free_lconv_mon 14 API calls 8669->8672 8670->8669 8673 a6f885 8671->8673 8675 a6d4db ___free_lconv_mon 14 API calls 8671->8675 8672->8671 8674 a6f897 8673->8674 8676 a6d4db ___free_lconv_mon 14 API calls 8673->8676 8677 a6f8a9 8674->8677 8678 a6d4db ___free_lconv_mon 14 API calls 8674->8678 8675->8673 8676->8674 8679 a6f8bb 8677->8679 8680 a6d4db ___free_lconv_mon 14 API calls 8677->8680 8678->8677 8681 a6f8cd 8679->8681 8683 a6d4db ___free_lconv_mon 14 API calls 8679->8683 8680->8679 8682 a6f8df 8681->8682 8684 a6d4db ___free_lconv_mon 14 API calls 8681->8684 8685 a6f8f1 8682->8685 8686 a6d4db ___free_lconv_mon 14 API calls 8682->8686 8683->8681 8684->8682 8687 a6d4db ___free_lconv_mon 14 API calls 8685->8687 8685->8688 8686->8685 8687->8688 8688->8639 8690 a6f914 8689->8690 8700 a6f96c 8689->8700 8691 a6f924 8690->8691 8692 a6d4db ___free_lconv_mon 14 API calls 8690->8692 8693 a6d4db ___free_lconv_mon 14 API calls 8691->8693 8694 a6f936 8691->8694 8692->8691 8693->8694 8695 a6d4db ___free_lconv_mon 14 API calls 8694->8695 8696 a6f948 8694->8696 8695->8696 8697 a6f95a 8696->8697 8698 a6d4db ___free_lconv_mon 14 API calls 8696->8698 8699 a6d4db ___free_lconv_mon 14 API calls 8697->8699 8697->8700 8698->8697 8699->8700 8700->8641 8702 a6fe58 8701->8702 8703 a6fe39 8701->8703 8702->8643 8703->8702 8707 a6f995 8703->8707 8706 a6d4db ___free_lconv_mon 14 API calls 8706->8702 8708 a6fa73 8707->8708 8709 a6f9a6 8707->8709 8708->8706 8710 a6f970 _unexpected 14 API calls 8709->8710 8711 a6f9ae 8710->8711 8712 a6f970 _unexpected 14 API calls 8711->8712 8713 a6f9b9 8712->8713 8714 a6f970 _unexpected 14 API calls 8713->8714 8715 a6f9c4 8714->8715 8716 a6f970 _unexpected 14 API calls 8715->8716 8717 a6f9cf 8716->8717 8718 a6f970 _unexpected 14 API calls 8717->8718 8719 a6f9dd 8718->8719 8720 a6d4db ___free_lconv_mon 14 API calls 8719->8720 8721 a6f9e8 8720->8721 8722 a6d4db ___free_lconv_mon 14 API calls 8721->8722 8723 a6f9f3 8722->8723 8724 a6d4db ___free_lconv_mon 14 API calls 8723->8724 8725 a6f9fe 8724->8725 8726 a6f970 _unexpected 14 API calls 8725->8726 8727 a6fa0c 8726->8727 8728 a6f970 _unexpected 14 API calls 8727->8728 8729 a6fa1a 8728->8729 8730 a6f970 _unexpected 14 API calls 8729->8730 8731 a6fa2b 8730->8731 8732 a6f970 _unexpected 14 API calls 8731->8732 8733 a6fa39 8732->8733 8734 a6f970 _unexpected 14 API calls 8733->8734 8735 a6fa47 8734->8735 8736 a6d4db ___free_lconv_mon 14 API calls 8735->8736 8737 a6fa52 8736->8737 8738 a6d4db ___free_lconv_mon 14 API calls 8737->8738 8739 a6fa5d 8738->8739 8740 a6d4db ___free_lconv_mon 14 API calls 8739->8740 8741 a6fa68 8740->8741 8742 a6d4db ___free_lconv_mon 14 API calls 8741->8742 8742->8708 8743->8632 8745 a6d1f0 _unexpected 41 API calls 8744->8745 8746 a6e20b 8745->8746 8747 a6e11e ___scrt_uninitialize_crt 41 API calls 8746->8747 8748 a6e216 8747->8748 8748->8611 8750 a6de45 GetCPInfo 8749->8750 8751 a6df0e 8749->8751 8750->8751 8756 a6de5d 8750->8756 8753 a673a8 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 8751->8753 8755 a6dfc7 8753->8755 8755->8581 8760 a6fb15 8756->8760 8759 a70d5e 45 API calls 8759->8751 8761 a6dad9 41 API calls 8760->8761 8762 a6fb35 8761->8762 8780 a6e4bb 8762->8780 8764 a6fbf9 8767 a673a8 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 8764->8767 8765 a6fbf1 8783 a6fc1e 8765->8783 8766 a6fb62 8766->8764 8766->8765 8769 a6fa79 15 API calls 8766->8769 8771 a6fb87 __CreateFrameInfo __alloca_probe_16 8766->8771 8770 a6dec5 8767->8770 8769->8771 8775 a70d5e 8770->8775 8771->8765 8772 a6e4bb ___scrt_uninitialize_crt MultiByteToWideChar 8771->8772 8773 a6fbd2 8772->8773 8773->8765 8774 a6fbdd GetStringTypeW 8773->8774 8774->8765 8776 a6dad9 41 API calls 8775->8776 8777 a70d71 8776->8777 8787 a70b70 8777->8787 8782 a6e4cc MultiByteToWideChar 8780->8782 8782->8766 8784 a6fc3b 8783->8784 8785 a6fc2a 8783->8785 8784->8764 8785->8784 8786 a6d4db ___free_lconv_mon 14 API calls 8785->8786 8786->8784 8788 a70b8b 8787->8788 8789 a6e4bb ___scrt_uninitialize_crt MultiByteToWideChar 8788->8789 8792 a70bd1 8789->8792 8790 a70d49 8791 a673a8 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 8790->8791 8793 a6dee6 8791->8793 8792->8790 8794 a6fa79 15 API calls 8792->8794 8796 a70bf7 __alloca_probe_16 8792->8796 8803 a70c7d 8792->8803 8793->8759 8794->8796 8795 a6fc1e __freea 14 API calls 8795->8790 8797 a6e4bb ___scrt_uninitialize_crt MultiByteToWideChar 8796->8797 8796->8803 8798 a70c3c 8797->8798 8798->8803 8815 a6e97f 8798->8815 8801 a70ca6 8804 a70d31 8801->8804 8807 a6fa79 15 API calls 8801->8807 8808 a70cb8 __alloca_probe_16 8801->8808 8802 a70c6e 8802->8803 8806 a6e97f 6 API calls 8802->8806 8803->8795 8805 a6fc1e __freea 14 API calls 8804->8805 8805->8803 8806->8803 8807->8808 8808->8804 8809 a6e97f 6 API calls 8808->8809 8810 a70cfb 8809->8810 8810->8804 8821 a6e537 8810->8821 8812 a70d15 8812->8804 8813 a70d1e 8812->8813 8814 a6fc1e __freea 14 API calls 8813->8814 8814->8803 8824 a6e673 8815->8824 8819 a6e9d0 LCMapStringW 8820 a6e990 8819->8820 8820->8801 8820->8802 8820->8803 8823 a6e54e WideCharToMultiByte 8821->8823 8823->8812 8825 a6e772 _unexpected 5 API calls 8824->8825 8826 a6e689 8825->8826 8826->8820 8827 a6e9dc 8826->8827 8830 a6e68d 8827->8830 8829 a6e9e7 8829->8819 8831 a6e772 _unexpected 5 API calls 8830->8831 8832 a6e6a3 8831->8832 8832->8829 8833->8586 8844 a6e421 8834->8844 8836 a6dcaa 8837 a6e421 41 API calls 8836->8837 8838 a6dcc9 8837->8838 8839 a6d4db ___free_lconv_mon 14 API calls 8838->8839 8840 a6dc5e 8838->8840 8839->8840 8841 a6dc7c 8840->8841 8858 a6d63a LeaveCriticalSection 8841->8858 8843 a6dc6a 8843->8541 8845 a6e432 8844->8845 8854 a6e42e __InternalCxxFrameHandler 8844->8854 8846 a6e439 8845->8846 8849 a6e44c __CreateFrameInfo 8845->8849 8847 a6baa8 ___free_lconv_mon 14 API calls 8846->8847 8848 a6e43e 8847->8848 8850 a6b9ea ___std_exception_copy 41 API calls 8848->8850 8851 a6e483 8849->8851 8852 a6e47a 8849->8852 8849->8854 8850->8854 8851->8854 8856 a6baa8 ___free_lconv_mon 14 API calls 8851->8856 8853 a6baa8 ___free_lconv_mon 14 API calls 8852->8853 8855 a6e47f 8853->8855 8854->8836 8857 a6b9ea ___std_exception_copy 41 API calls 8855->8857 8856->8855 8857->8854 8858->8843 8966 a6d0b7 8967 a6d0d2 8966->8967 8968 a6d0c2 8966->8968 8972 a6d0d8 8968->8972 8971 a6d4db ___free_lconv_mon 14 API calls 8971->8967 8973 a6d0ed 8972->8973 8977 a6d0f3 8972->8977 8975 a6d4db ___free_lconv_mon 14 API calls 8973->8975 8974 a6d4db ___free_lconv_mon 14 API calls 8976 a6d0ff 8974->8976 8975->8977 8978 a6d4db ___free_lconv_mon 14 API calls 8976->8978 8977->8974 8979 a6d10a 8978->8979 8980 a6d4db ___free_lconv_mon 14 API calls 8979->8980 8981 a6d115 8980->8981 8982 a6d4db ___free_lconv_mon 14 API calls 8981->8982 8983 a6d120 8982->8983 8984 a6d4db ___free_lconv_mon 14 API calls 8983->8984 8985 a6d12b 8984->8985 8986 a6d4db ___free_lconv_mon 14 API calls 8985->8986 8987 a6d136 8986->8987 8988 a6d4db ___free_lconv_mon 14 API calls 8987->8988 8989 a6d141 8988->8989 8990 a6d4db ___free_lconv_mon 14 API calls 8989->8990 8991 a6d14c 8990->8991 8992 a6d4db ___free_lconv_mon 14 API calls 8991->8992 8993 a6d15a 8992->8993 8998 a6cf04 8993->8998 8999 a6cf10 __FrameHandler3::FrameUnwindToState 8998->8999 9014 a6d5f2 EnterCriticalSection 8999->9014 9001 a6cf1a 9004 a6d4db ___free_lconv_mon 14 API calls 9001->9004 9005 a6cf44 9001->9005 9004->9005 9015 a6cf63 9005->9015 9006 a6cf6f 9007 a6cf7b __FrameHandler3::FrameUnwindToState 9006->9007 9019 a6d5f2 EnterCriticalSection 9007->9019 9009 a6cf85 9010 a6d1a5 _unexpected 14 API calls 9009->9010 9011 a6cf98 9010->9011 9020 a6cfb8 9011->9020 9014->9001 9018 a6d63a LeaveCriticalSection 9015->9018 9017 a6cf51 9017->9006 9018->9017 9019->9009 9023 a6d63a LeaveCriticalSection 9020->9023 9022 a6cfa6 9022->8971 9023->9022 7550 a678bf 7551 a678cb __FrameHandler3::FrameUnwindToState 7550->7551 7576 a67611 7551->7576 7553 a678d2 7554 a67a25 7553->7554 7564 a678fc ___scrt_is_nonwritable_in_current_image __CreateFrameInfo ___scrt_release_startup_lock 7553->7564 7627 a67b6a IsProcessorFeaturePresent 7554->7627 7556 a67a2c 7607 a6bfb5 7556->7607 7561 a6791b 7562 a6799c 7587 a67c85 7562->7587 7564->7561 7564->7562 7610 a6bf8f 7564->7610 7565 a679a2 7591 a66bd8 GetModuleHandleW GetProcAddress 7565->7591 7568 a679b7 7616 a67cbe GetModuleHandleW 7568->7616 7571 a679c2 7572 a679cb 7571->7572 7618 a6bf6a 7571->7618 7621 a67782 7572->7621 7577 a6761a 7576->7577 7634 a67d6b IsProcessorFeaturePresent 7577->7634 7581 a6762b 7586 a6762f 7581->7586 7644 a6c967 7581->7644 7584 a67646 7584->7553 7586->7553 7961 a69590 7587->7961 7590 a67cab 7590->7565 7592 a66bf7 7591->7592 7963 a66841 7592->7963 7594 a66c06 7990 a66d91 7594->7990 7596 a66c10 7993 a66a46 7596->7993 7599 a66c25 LoadLibraryExW 7601 a66c41 GetProcAddress 7599->7601 7602 a66c38 7599->7602 7600 a66c3d 7600->7568 7604 a66c5f FreeLibrary 7601->7604 7605 a66c53 GetCommandLineW 7601->7605 8024 a667da GetLastError 7602->8024 7604->7600 7605->7604 8240 a6bde0 7607->8240 7611 a6bfa5 __FrameHandler3::FrameUnwindToState _unexpected 7610->7611 7611->7562 8315 a6d1f0 GetLastError 7611->8315 7613 a6cce5 __FrameHandler3::FrameUnwindToState 41 API calls 7614 a6cc85 7613->7614 7617 a679be 7616->7617 7617->7556 7617->7571 7619 a6bde0 __CreateFrameInfo 23 API calls 7618->7619 7620 a6bf75 7619->7620 7620->7572 7622 a6778e 7621->7622 7623 a677a4 7622->7623 8342 a6c979 7622->8342 7623->7561 7625 a6779c 7626 a69709 ___scrt_uninitialize_crt 7 API calls 7625->7626 7626->7623 7628 a67b80 __CreateFrameInfo 7627->7628 7629 a67c2b IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 7628->7629 7630 a67c76 __CreateFrameInfo 7629->7630 7630->7556 7631 a6bf79 7632 a6bde0 __CreateFrameInfo 23 API calls 7631->7632 7633 a67a3a 7632->7633 7635 a67626 7634->7635 7636 a696ea 7635->7636 7653 a69bc2 7636->7653 7640 a696fb 7641 a69706 7640->7641 7667 a69bfe 7640->7667 7641->7581 7643 a696f3 7643->7581 7709 a6ec64 7644->7709 7647 a69709 7648 a69712 7647->7648 7649 a6971c 7647->7649 7650 a69ba7 ___vcrt_uninitialize_ptd 6 API calls 7648->7650 7649->7586 7651 a69717 7650->7651 7652 a69bfe ___vcrt_uninitialize_locks DeleteCriticalSection 7651->7652 7652->7649 7656 a69bcb 7653->7656 7655 a69bf4 7658 a69bfe ___vcrt_uninitialize_locks DeleteCriticalSection 7655->7658 7656->7655 7657 a696ef 7656->7657 7671 a69f99 7656->7671 7657->7643 7659 a69b74 7657->7659 7658->7657 7690 a69eaa 7659->7690 7663 a69ba4 7663->7640 7666 a69b89 7666->7640 7668 a69c28 7667->7668 7669 a69c09 7667->7669 7668->7643 7670 a69c13 DeleteCriticalSection 7669->7670 7670->7668 7670->7670 7676 a69e61 7671->7676 7674 a69fd1 InitializeCriticalSectionAndSpinCount 7675 a69fbc 7674->7675 7675->7656 7677 a69e9c 7676->7677 7678 a69e79 7676->7678 7677->7674 7677->7675 7678->7677 7682 a69dc7 7678->7682 7681 a69e8e GetProcAddress 7681->7677 7687 a69dd3 ___vcrt_InitializeCriticalSectionEx 7682->7687 7683 a69e47 7683->7677 7683->7681 7684 a69de9 LoadLibraryExW 7685 a69e07 GetLastError 7684->7685 7686 a69e4e 7684->7686 7685->7687 7686->7683 7688 a69e56 FreeLibrary 7686->7688 7687->7683 7687->7684 7689 a69e29 LoadLibraryExW 7687->7689 7688->7683 7689->7686 7689->7687 7691 a69e61 ___vcrt_InitializeCriticalSectionEx 5 API calls 7690->7691 7692 a69ec4 7691->7692 7693 a69edd TlsAlloc 7692->7693 7694 a69b7e 7692->7694 7694->7666 7695 a69f5b 7694->7695 7696 a69e61 ___vcrt_InitializeCriticalSectionEx 5 API calls 7695->7696 7697 a69f75 7696->7697 7698 a69f90 TlsSetValue 7697->7698 7699 a69b97 7697->7699 7698->7699 7699->7663 7700 a69ba7 7699->7700 7701 a69bb1 7700->7701 7702 a69bb7 7700->7702 7704 a69ee5 7701->7704 7702->7666 7705 a69e61 ___vcrt_InitializeCriticalSectionEx 5 API calls 7704->7705 7706 a69eff 7705->7706 7707 a69f17 TlsFree 7706->7707 7708 a69f0b 7706->7708 7707->7708 7708->7702 7710 a6ec74 7709->7710 7711 a67638 7709->7711 7710->7711 7713 a6ebd8 7710->7713 7711->7584 7711->7647 7714 a6ebe4 __FrameHandler3::FrameUnwindToState 7713->7714 7725 a6d5f2 EnterCriticalSection 7714->7725 7716 a6ebeb 7726 a6f614 7716->7726 7719 a6ec09 7750 a6ec2f 7719->7750 7725->7716 7727 a6f620 __FrameHandler3::FrameUnwindToState 7726->7727 7728 a6f64a 7727->7728 7729 a6f629 7727->7729 7753 a6d5f2 EnterCriticalSection 7728->7753 7761 a6baa8 7729->7761 7734 a6ebfa 7734->7719 7739 a6ea72 GetStartupInfoW 7734->7739 7735 a6f682 7767 a6f6a9 7735->7767 7737 a6f656 7737->7735 7754 a6f564 7737->7754 7740 a6eb23 7739->7740 7741 a6ea8f 7739->7741 7745 a6eb28 7740->7745 7741->7740 7742 a6f614 42 API calls 7741->7742 7743 a6eab7 7742->7743 7743->7740 7744 a6eae7 GetFileType 7743->7744 7744->7743 7746 a6eb2f 7745->7746 7747 a6eb72 GetStdHandle 7746->7747 7748 a6ebd4 7746->7748 7749 a6eb85 GetFileType 7746->7749 7747->7746 7748->7719 7749->7746 7960 a6d63a LeaveCriticalSection 7750->7960 7752 a6ec1a 7752->7710 7753->7737 7770 a6d682 7754->7770 7756 a6f576 7760 a6f583 7756->7760 7777 a6e934 7756->7777 7782 a6d4db 7760->7782 7815 a6d341 GetLastError 7761->7815 7763 a6baad 7764 a6b9ea 7763->7764 7879 a6b936 7764->7879 7959 a6d63a LeaveCriticalSection 7767->7959 7769 a6f6b0 7769->7734 7776 a6d68f _unexpected 7770->7776 7771 a6d6cf 7773 a6baa8 ___free_lconv_mon 13 API calls 7771->7773 7772 a6d6ba RtlAllocateHeap 7774 a6d6cd 7772->7774 7772->7776 7773->7774 7774->7756 7776->7771 7776->7772 7788 a6ed0c 7776->7788 7801 a6e772 7777->7801 7779 a6e950 7780 a6e96e InitializeCriticalSectionAndSpinCount 7779->7780 7781 a6e959 7779->7781 7780->7781 7781->7756 7783 a6d4e6 HeapFree 7782->7783 7784 a6d510 7782->7784 7783->7784 7785 a6d4fb GetLastError 7783->7785 7784->7737 7786 a6d508 ___free_lconv_mon 7785->7786 7787 a6baa8 ___free_lconv_mon 12 API calls 7786->7787 7787->7784 7791 a6ed39 7788->7791 7792 a6ed45 __FrameHandler3::FrameUnwindToState 7791->7792 7797 a6d5f2 EnterCriticalSection 7792->7797 7794 a6ed50 7798 a6ed8c 7794->7798 7797->7794 7799 a6d63a __CreateFrameInfo LeaveCriticalSection 7798->7799 7800 a6ed17 7799->7800 7800->7776 7802 a6e7a0 7801->7802 7803 a6e79c _unexpected 7801->7803 7802->7803 7807 a6e6a7 7802->7807 7803->7779 7806 a6e7ba GetProcAddress 7806->7803 7808 a6e6b8 ___vcrt_InitializeCriticalSectionEx 7807->7808 7809 a6e74e 7808->7809 7810 a6e6d6 LoadLibraryExW 7808->7810 7814 a6e724 LoadLibraryExW 7808->7814 7809->7803 7809->7806 7811 a6e755 7810->7811 7812 a6e6f1 GetLastError 7810->7812 7811->7809 7813 a6e767 FreeLibrary 7811->7813 7812->7808 7813->7809 7814->7808 7814->7811 7816 a6d357 7815->7816 7819 a6d35d 7815->7819 7838 a6e8b3 7816->7838 7836 a6d361 SetLastError 7819->7836 7843 a6e8f2 7819->7843 7822 a6d682 _unexpected 12 API calls 7823 a6d38e 7822->7823 7824 a6d396 7823->7824 7825 a6d3a7 7823->7825 7826 a6e8f2 _unexpected 6 API calls 7824->7826 7827 a6e8f2 _unexpected 6 API calls 7825->7827 7828 a6d3a4 7826->7828 7829 a6d3b3 7827->7829 7834 a6d4db ___free_lconv_mon 12 API calls 7828->7834 7830 a6d3b7 7829->7830 7831 a6d3ce 7829->7831 7833 a6e8f2 _unexpected 6 API calls 7830->7833 7848 a6d01e 7831->7848 7833->7828 7834->7836 7836->7763 7837 a6d4db ___free_lconv_mon 12 API calls 7837->7836 7839 a6e772 _unexpected 5 API calls 7838->7839 7840 a6e8cf 7839->7840 7841 a6e8ea TlsGetValue 7840->7841 7842 a6e8d8 7840->7842 7842->7819 7844 a6e772 _unexpected 5 API calls 7843->7844 7845 a6e90e 7844->7845 7846 a6d379 7845->7846 7847 a6e92c TlsSetValue 7845->7847 7846->7822 7846->7836 7853 a6ceb2 7848->7853 7854 a6cebe __FrameHandler3::FrameUnwindToState 7853->7854 7867 a6d5f2 EnterCriticalSection 7854->7867 7856 a6cec8 7868 a6cef8 7856->7868 7859 a6cfc4 7860 a6cfd0 __FrameHandler3::FrameUnwindToState 7859->7860 7871 a6d5f2 EnterCriticalSection 7860->7871 7862 a6cfda 7872 a6d1a5 7862->7872 7864 a6cff2 7876 a6d012 7864->7876 7867->7856 7869 a6d63a __CreateFrameInfo LeaveCriticalSection 7868->7869 7870 a6cee6 7869->7870 7870->7859 7871->7862 7873 a6d1b4 _unexpected 7872->7873 7874 a6d1db _unexpected 7872->7874 7873->7874 7875 a6fcbb _unexpected 14 API calls 7873->7875 7874->7864 7875->7874 7877 a6d63a __CreateFrameInfo LeaveCriticalSection 7876->7877 7878 a6d000 7877->7878 7878->7837 7880 a6b948 ___std_exception_copy 7879->7880 7885 a6b96d 7880->7885 7882 a6b960 7896 a6b726 7882->7896 7886 a6b97d 7885->7886 7888 a6b984 7885->7888 7902 a6b78b GetLastError 7886->7902 7889 a6b992 7888->7889 7906 a6b762 7888->7906 7889->7882 7891 a6b9b9 7891->7889 7909 a6b9fa IsProcessorFeaturePresent 7891->7909 7893 a6b9e9 7894 a6b936 ___std_exception_copy 41 API calls 7893->7894 7895 a6b9f6 7894->7895 7895->7882 7897 a6b732 7896->7897 7898 a6b749 7897->7898 7941 a6b7d1 7897->7941 7900 a6b75c 7898->7900 7901 a6b7d1 ___std_exception_copy 41 API calls 7898->7901 7900->7734 7901->7900 7903 a6b7a4 7902->7903 7913 a6d3f2 7903->7913 7907 a6b786 7906->7907 7908 a6b76d GetLastError SetLastError 7906->7908 7907->7891 7908->7891 7910 a6ba06 7909->7910 7935 a6b7ee 7910->7935 7914 a6d405 7913->7914 7915 a6d40b 7913->7915 7917 a6e8b3 _unexpected 6 API calls 7914->7917 7916 a6e8f2 _unexpected 6 API calls 7915->7916 7934 a6b7bc SetLastError 7915->7934 7918 a6d425 7916->7918 7917->7915 7919 a6d682 _unexpected 14 API calls 7918->7919 7918->7934 7920 a6d435 7919->7920 7921 a6d452 7920->7921 7922 a6d43d 7920->7922 7923 a6e8f2 _unexpected 6 API calls 7921->7923 7924 a6e8f2 _unexpected 6 API calls 7922->7924 7925 a6d45e 7923->7925 7931 a6d449 7924->7931 7926 a6d462 7925->7926 7927 a6d471 7925->7927 7928 a6e8f2 _unexpected 6 API calls 7926->7928 7929 a6d01e _unexpected 14 API calls 7927->7929 7928->7931 7932 a6d47c 7929->7932 7930 a6d4db ___free_lconv_mon 14 API calls 7930->7934 7931->7930 7933 a6d4db ___free_lconv_mon 14 API calls 7932->7933 7933->7934 7934->7888 7936 a6b80a __CreateFrameInfo 7935->7936 7937 a6b836 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 7936->7937 7940 a6b907 __CreateFrameInfo 7937->7940 7938 a673a8 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 7939 a6b925 GetCurrentProcess TerminateProcess 7938->7939 7939->7893 7940->7938 7942 a6b7e4 7941->7942 7943 a6b7db 7941->7943 7942->7898 7944 a6b78b ___std_exception_copy 16 API calls 7943->7944 7945 a6b7e0 7944->7945 7945->7942 7948 a6cce5 7945->7948 7949 a6ee63 __CreateFrameInfo EnterCriticalSection LeaveCriticalSection 7948->7949 7950 a6ccea 7949->7950 7951 a6ccf5 7950->7951 7952 a6eea8 __CreateFrameInfo 40 API calls 7950->7952 7953 a6ccff IsProcessorFeaturePresent 7951->7953 7958 a6cd1e 7951->7958 7952->7951 7954 a6cd0b 7953->7954 7957 a6b7ee __CreateFrameInfo 8 API calls 7954->7957 7955 a6bf79 __CreateFrameInfo 23 API calls 7956 a6cd28 7955->7956 7957->7958 7958->7955 7959->7769 7960->7752 7962 a67c98 GetStartupInfoW 7961->7962 7962->7590 7964 a66d91 56 API calls 7963->7964 7965 a66852 7964->7965 7966 a6686b GetModuleFileNameW 7965->7966 7967 a66883 7966->7967 7968 a6695a 7967->7968 8026 a6660f 7967->8026 7968->7594 7970 a6699d 7972 a668c0 8056 a66f37 7972->8056 7973 a668ce 8065 a66e65 7973->8065 7976 a668cc 8041 a66c80 7976->8041 7978 a668eb 8045 a66fb4 7978->8045 7980 a668f6 8049 a66d30 7980->8049 7982 a66908 7983 a66d91 56 API calls 7982->7983 7984 a66918 7983->7984 7985 a6692d SHGetFolderPathW 7984->7985 7986 a66946 7985->7986 7986->7968 8078 a66cf6 7986->8078 7988 a66952 7989 a66cf6 CharLowerBuffW 7988->7989 7989->7968 7991 a6660f 56 API calls 7990->7991 7992 a66d99 7991->7992 7992->7596 7994 a66a7b __CreateFrameInfo 7993->7994 7995 a66a8a GetModuleFileNameW 7994->7995 7996 a66aa5 7995->7996 7997 a66aaf PathRemoveFileSpecW 7995->7997 7998 a667da GetLastError 7996->7998 8220 a6b67a 7997->8220 8015 a66aaa 7998->8015 8001 a66aeb 8229 a667f5 8001->8229 8004 a66bd6 8004->7599 8004->7600 8006 a66b1d 8008 a6b67a 41 API calls 8006->8008 8007 a66afa 8010 a66e65 41 API calls 8007->8010 8009 a66b35 8008->8009 8011 a66d91 56 API calls 8009->8011 8010->8015 8012 a66b43 8011->8012 8235 a669a8 RegOpenKeyExW 8012->8235 8014 a66b54 8014->8015 8016 a66b5a PathAppendW 8014->8016 8213 a673a8 8015->8213 8017 a66b7f 8016->8017 8018 a66b6d PathAppendW 8016->8018 8020 a667da GetLastError 8017->8020 8018->8017 8019 a66b88 8018->8019 8021 a667f5 6 API calls 8019->8021 8020->8015 8022 a66b93 8021->8022 8022->8015 8023 a66e65 41 API calls 8022->8023 8023->8015 8025 a667e4 8024->8025 8025->7600 8027 a6663d 8026->8027 8038 a66626 8026->8038 8083 a674c5 EnterCriticalSection 8027->8083 8029 a66648 8031 a66652 GetProcessHeap 8029->8031 8029->8038 8030 a674c5 6 API calls 8032 a6668d 8030->8032 8088 a677d7 8031->8088 8035 a677d7 44 API calls 8032->8035 8040 a66638 8032->8040 8037 a666da 8035->8037 8039 a6747b __Init_thread_footer 5 API calls 8037->8039 8038->8030 8038->8040 8039->8040 8040->7970 8040->7972 8040->7973 8164 a66db8 8041->8164 8043 a66c8e PathRemoveFileSpecW 8044 a66c9d 8043->8044 8044->7978 8047 a66fbf 8045->8047 8046 a66fcd 8046->7980 8047->8046 8166 a6705e 8047->8166 8050 a66d48 8049->8050 8055 a66d5c 8049->8055 8051 a66d7d 8050->8051 8053 a66d57 8050->8053 8052 a66e65 41 API calls 8051->8052 8052->8055 8054 a66fb4 14 API calls 8053->8054 8054->8055 8055->7982 8172 a67341 EnterCriticalSection 8056->8172 8058 a66f4c 8059 a66f62 FindResourceExW 8058->8059 8061 a67341 5 API calls 8058->8061 8062 a66f9a 8058->8062 8064 a66fa9 8058->8064 8177 a664f9 LoadResource 8058->8177 8059->8058 8061->8058 8062->8064 8181 a670d2 FindResourceW 8062->8181 8064->7976 8067 a66e7d 8065->8067 8068 a66e73 __InternalCxxFrameHandler 8065->8068 8066 a66f11 8067->8066 8069 a66ef7 8067->8069 8070 a66ead 8067->8070 8068->7976 8071 a6705e 14 API calls 8069->8071 8070->8068 8072 a66ebe 8070->8072 8074 a66ed4 8070->8074 8071->8068 8073 a6baa8 ___free_lconv_mon 14 API calls 8072->8073 8075 a66ec3 8073->8075 8074->8068 8076 a6baa8 ___free_lconv_mon 14 API calls 8074->8076 8077 a6b9ea ___std_exception_copy 41 API calls 8075->8077 8076->8075 8077->8068 8079 a66d05 8078->8079 8080 a66d25 8079->8080 8081 a66d10 CharLowerBuffW 8079->8081 8082 a66d20 8081->8082 8082->7988 8084 a674d9 8083->8084 8085 a674de LeaveCriticalSection 8084->8085 8096 a6754d 8084->8096 8085->8029 8101 a677aa 8088->8101 8091 a6747b EnterCriticalSection LeaveCriticalSection 8092 a67517 8091->8092 8093 a67522 RtlWakeAllConditionVariable 8092->8093 8094 a67533 SetEvent ResetEvent 8092->8094 8093->8038 8094->8038 8097 a67574 LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 8096->8097 8098 a6755b SleepConditionVariableCS 8096->8098 8099 a67598 8097->8099 8098->8099 8099->8084 8102 a677c0 8101->8102 8103 a677b9 8101->8103 8110 a6c839 8102->8110 8107 a6c7bc 8103->8107 8106 a66678 8106->8091 8108 a6c839 44 API calls 8107->8108 8109 a6c7ce 8108->8109 8109->8106 8113 a6c585 8110->8113 8114 a6c591 __FrameHandler3::FrameUnwindToState 8113->8114 8121 a6d5f2 EnterCriticalSection 8114->8121 8116 a6c59f 8122 a6c5e0 8116->8122 8118 a6c5ac 8132 a6c5d4 8118->8132 8121->8116 8123 a6c5fb 8122->8123 8124 a6c66e _unexpected 8122->8124 8123->8124 8125 a6c64e 8123->8125 8135 a6bad6 8123->8135 8124->8118 8125->8124 8127 a6bad6 44 API calls 8125->8127 8129 a6c664 8127->8129 8128 a6c644 8130 a6d4db ___free_lconv_mon 14 API calls 8128->8130 8131 a6d4db ___free_lconv_mon 14 API calls 8129->8131 8130->8125 8131->8124 8163 a6d63a LeaveCriticalSection 8132->8163 8134 a6c5bd 8134->8106 8136 a6bae3 8135->8136 8137 a6bafe 8135->8137 8136->8137 8138 a6baef 8136->8138 8139 a6bb0d 8137->8139 8144 a6d515 8137->8144 8140 a6baa8 ___free_lconv_mon 14 API calls 8138->8140 8151 a6d548 8139->8151 8143 a6baf4 __CreateFrameInfo 8140->8143 8143->8128 8145 a6d535 HeapSize 8144->8145 8146 a6d520 8144->8146 8145->8139 8147 a6baa8 ___free_lconv_mon 14 API calls 8146->8147 8148 a6d525 8147->8148 8149 a6b9ea ___std_exception_copy 41 API calls 8148->8149 8150 a6d530 8149->8150 8150->8139 8152 a6d555 8151->8152 8153 a6d560 8151->8153 8154 a6fa79 15 API calls 8152->8154 8155 a6d568 8153->8155 8161 a6d571 _unexpected 8153->8161 8159 a6d55d 8154->8159 8156 a6d4db ___free_lconv_mon 14 API calls 8155->8156 8156->8159 8157 a6d576 8160 a6baa8 ___free_lconv_mon 14 API calls 8157->8160 8158 a6d59b HeapReAlloc 8158->8159 8158->8161 8159->8143 8160->8159 8161->8157 8161->8158 8162 a6ed0c _unexpected EnterCriticalSection LeaveCriticalSection 8161->8162 8162->8161 8163->8134 8165 a66de9 8164->8165 8167 a67070 8166->8167 8168 a67093 __InternalCxxFrameHandler 8166->8168 8169 a6baa8 ___free_lconv_mon 14 API calls 8167->8169 8171 a67079 __CreateFrameInfo 8167->8171 8168->8046 8169->8171 8170 a6baa8 14 API calls ___free_lconv_mon 8170->8171 8171->8168 8171->8170 8173 a67363 LeaveCriticalSection 8172->8173 8174 a6735a 8172->8174 8173->8058 8174->8173 8187 a6731c 8174->8187 8178 a6650f LockResource 8177->8178 8180 a6652f 8177->8180 8179 a6651c SizeofResource 8178->8179 8178->8180 8179->8180 8180->8058 8182 a670f3 8181->8182 8184 a67122 8181->8184 8183 a664f9 3 API calls 8182->8183 8185 a67100 8183->8185 8184->8064 8185->8184 8199 a6b5ca 8185->8199 8188 a67326 8187->8188 8189 a6732b 8188->8189 8197 a66460 RaiseException 8188->8197 8189->8173 8193 a67363 LeaveCriticalSection 8193->8173 8194 a6735a 8194->8193 8196 a6731c RaiseException 8194->8196 8196->8193 8198 a66474 EnterCriticalSection 8197->8198 8198->8193 8198->8194 8200 a6b5db 8199->8200 8209 a6b5d7 __InternalCxxFrameHandler 8199->8209 8201 a6b5e2 8200->8201 8203 a6b5f5 _wmemset 8200->8203 8202 a6baa8 ___free_lconv_mon 14 API calls 8201->8202 8204 a6b5e7 8202->8204 8206 a6b626 8203->8206 8207 a6b62f 8203->8207 8203->8209 8205 a6b9ea ___std_exception_copy 41 API calls 8204->8205 8205->8209 8208 a6baa8 ___free_lconv_mon 14 API calls 8206->8208 8207->8209 8211 a6baa8 ___free_lconv_mon 14 API calls 8207->8211 8210 a6b62b 8208->8210 8209->8184 8212 a6b9ea ___std_exception_copy 41 API calls 8210->8212 8211->8210 8212->8209 8214 a673b0 8213->8214 8215 a673b1 IsProcessorFeaturePresent 8213->8215 8214->8004 8217 a67a85 8215->8217 8239 a67a48 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 8217->8239 8219 a67b68 8219->8004 8221 a6b696 8220->8221 8222 a6b688 8220->8222 8223 a6baa8 ___free_lconv_mon 14 API calls 8221->8223 8222->8221 8224 a6b6b0 8222->8224 8228 a6b6a0 8223->8228 8226 a66ad0 PathAppendW 8224->8226 8227 a6baa8 ___free_lconv_mon 14 API calls 8224->8227 8225 a6b9ea ___std_exception_copy 41 API calls 8225->8226 8226->7996 8226->8001 8227->8228 8228->8225 8230 a66832 8229->8230 8231 a6680c 8229->8231 8233 a673a8 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 8230->8233 8231->8230 8232 a66813 GetFileAttributesExW 8231->8232 8232->8230 8234 a6683f 8233->8234 8234->8006 8234->8007 8236 a669e5 8235->8236 8238 a669d9 8235->8238 8237 a669fd SHQueryValueExW 8236->8237 8237->8238 8238->8014 8239->8219 8241 a6be1f 8240->8241 8242 a6be0d 8240->8242 8252 a6bc89 8241->8252 8244 a67cbe __CreateFrameInfo GetModuleHandleW 8242->8244 8245 a6be12 8244->8245 8245->8241 8267 a6beca GetModuleHandleExW 8245->8267 8247 a67a32 8247->7631 8251 a6be71 8253 a6bc95 __FrameHandler3::FrameUnwindToState 8252->8253 8273 a6d5f2 EnterCriticalSection 8253->8273 8255 a6bc9f 8274 a6bcf5 8255->8274 8257 a6bcac 8278 a6bcca 8257->8278 8260 a6be77 8303 a6bea8 8260->8303 8263 a6be95 8265 a6beca __CreateFrameInfo 3 API calls 8263->8265 8264 a6be85 GetCurrentProcess TerminateProcess 8264->8263 8266 a6be9d ExitProcess 8265->8266 8268 a6bf2a 8267->8268 8269 a6bf09 GetProcAddress 8267->8269 8271 a6bf30 FreeLibrary 8268->8271 8272 a6be1e 8268->8272 8269->8268 8270 a6bf1d 8269->8270 8270->8268 8271->8272 8272->8241 8273->8255 8275 a6bd01 __FrameHandler3::FrameUnwindToState 8274->8275 8277 a6bd68 __CreateFrameInfo 8275->8277 8281 a6c7d2 8275->8281 8277->8257 8302 a6d63a LeaveCriticalSection 8278->8302 8280 a6bcb8 8280->8247 8280->8260 8282 a6c7de __EH_prolog3 8281->8282 8285 a6c52a 8282->8285 8284 a6c805 __CreateFrameInfo 8284->8277 8286 a6c536 __FrameHandler3::FrameUnwindToState 8285->8286 8293 a6d5f2 EnterCriticalSection 8286->8293 8288 a6c544 8294 a6c6e2 8288->8294 8293->8288 8295 a6c701 8294->8295 8296 a6c551 8294->8296 8295->8296 8297 a6d4db ___free_lconv_mon 14 API calls 8295->8297 8298 a6c579 8296->8298 8297->8296 8301 a6d63a LeaveCriticalSection 8298->8301 8300 a6c562 8300->8284 8301->8300 8302->8280 8308 a6d651 GetPEB 8303->8308 8306 a6be81 8306->8263 8306->8264 8307 a6beb2 GetPEB 8307->8306 8309 a6bead 8308->8309 8310 a6d66b 8308->8310 8309->8306 8309->8307 8312 a6e7f5 8310->8312 8313 a6e772 _unexpected 5 API calls 8312->8313 8314 a6e811 8313->8314 8314->8309 8316 a6d206 8315->8316 8317 a6d20c 8315->8317 8319 a6e8b3 _unexpected 6 API calls 8316->8319 8318 a6e8f2 _unexpected 6 API calls 8317->8318 8340 a6d210 SetLastError 8317->8340 8320 a6d228 8318->8320 8319->8317 8322 a6d682 _unexpected 14 API calls 8320->8322 8320->8340 8323 a6d23d 8322->8323 8326 a6d256 8323->8326 8327 a6d245 8323->8327 8324 a6d2a5 8328 a6cce5 __FrameHandler3::FrameUnwindToState 39 API calls 8324->8328 8325 a6cc5b 8325->7613 8330 a6e8f2 _unexpected 6 API calls 8326->8330 8329 a6e8f2 _unexpected 6 API calls 8327->8329 8331 a6d2aa 8328->8331 8332 a6d253 8329->8332 8333 a6d262 8330->8333 8336 a6d4db ___free_lconv_mon 14 API calls 8332->8336 8334 a6d266 8333->8334 8335 a6d27d 8333->8335 8338 a6e8f2 _unexpected 6 API calls 8334->8338 8337 a6d01e _unexpected 14 API calls 8335->8337 8336->8340 8339 a6d288 8337->8339 8338->8332 8341 a6d4db ___free_lconv_mon 14 API calls 8339->8341 8340->8324 8340->8325 8341->8340 8343 a6c984 8342->8343 8345 a6c996 ___scrt_uninitialize_crt 8342->8345 8344 a6c992 8343->8344 8347 a6f346 8343->8347 8344->7625 8345->7625 8350 a6f1d3 8347->8350 8353 a6f127 8350->8353 8354 a6f133 __FrameHandler3::FrameUnwindToState 8353->8354 8361 a6d5f2 EnterCriticalSection 8354->8361 8356 a6f1a9 8370 a6f1c7 8356->8370 8357 a6f13d ___scrt_uninitialize_crt 8357->8356 8362 a6f09b 8357->8362 8361->8357 8363 a6f0a7 __FrameHandler3::FrameUnwindToState 8362->8363 8373 a6f463 EnterCriticalSection 8363->8373 8365 a6f0fd 8387 a6f11b 8365->8387 8367 a6f0b1 ___scrt_uninitialize_crt 8367->8365 8374 a6f2e1 8367->8374 8489 a6d63a LeaveCriticalSection 8370->8489 8372 a6f1b5 8372->8344 8373->8367 8375 a6f2f6 ___std_exception_copy 8374->8375 8376 a6f2fd 8375->8376 8377 a6f308 8375->8377 8378 a6f1d3 ___scrt_uninitialize_crt 70 API calls 8376->8378 8390 a6f278 8377->8390 8380 a6f303 8378->8380 8382 a6b726 ___std_exception_copy 41 API calls 8380->8382 8384 a6f340 8382->8384 8384->8365 8385 a6f329 8403 a70ed4 8385->8403 8488 a6f477 LeaveCriticalSection 8387->8488 8389 a6f109 8389->8357 8391 a6f291 8390->8391 8395 a6f2b8 8390->8395 8392 a7060d ___scrt_uninitialize_crt 41 API calls 8391->8392 8391->8395 8393 a6f2ad 8392->8393 8414 a716ff 8393->8414 8395->8380 8396 a7060d 8395->8396 8397 a7062e 8396->8397 8398 a70619 8396->8398 8397->8385 8399 a6baa8 ___free_lconv_mon 14 API calls 8398->8399 8400 a7061e 8399->8400 8401 a6b9ea ___std_exception_copy 41 API calls 8400->8401 8402 a70629 8401->8402 8402->8385 8404 a70ee5 8403->8404 8405 a70ef2 8403->8405 8406 a6baa8 ___free_lconv_mon 14 API calls 8404->8406 8407 a70f3b 8405->8407 8411 a70f19 8405->8411 8410 a70eea 8406->8410 8408 a6baa8 ___free_lconv_mon 14 API calls 8407->8408 8409 a70f40 8408->8409 8412 a6b9ea ___std_exception_copy 41 API calls 8409->8412 8410->8380 8455 a70e32 8411->8455 8412->8410 8415 a7170b __FrameHandler3::FrameUnwindToState 8414->8415 8416 a717cf 8415->8416 8418 a71760 8415->8418 8424 a71713 8415->8424 8417 a6b96d ___std_exception_copy 41 API calls 8416->8417 8417->8424 8425 a6f6b2 EnterCriticalSection 8418->8425 8420 a71766 8421 a71783 8420->8421 8426 a71807 8420->8426 8452 a717c7 8421->8452 8424->8395 8425->8420 8427 a7182c 8426->8427 8445 a7184f ___scrt_uninitialize_crt 8426->8445 8428 a71830 8427->8428 8430 a7188e 8427->8430 8429 a6b96d ___std_exception_copy 41 API calls 8428->8429 8429->8445 8431 a718a5 8430->8431 8432 a71ede ___scrt_uninitialize_crt 43 API calls 8430->8432 8433 a7138b ___scrt_uninitialize_crt 42 API calls 8431->8433 8432->8431 8434 a718af 8433->8434 8435 a718f5 8434->8435 8436 a718b5 8434->8436 8437 a71909 8435->8437 8438 a71958 WriteFile 8435->8438 8439 a718df 8436->8439 8440 a718bc 8436->8440 8443 a71946 8437->8443 8444 a71911 8437->8444 8441 a7197a GetLastError 8438->8441 8438->8445 8442 a70f51 ___scrt_uninitialize_crt 47 API calls 8439->8442 8440->8445 8448 a71323 ___scrt_uninitialize_crt 6 API calls 8440->8448 8441->8445 8442->8445 8449 a71409 ___scrt_uninitialize_crt 7 API calls 8443->8449 8446 a71916 8444->8446 8447 a71934 8444->8447 8445->8421 8446->8445 8451 a714e4 ___scrt_uninitialize_crt 7 API calls 8446->8451 8450 a715cd ___scrt_uninitialize_crt 8 API calls 8447->8450 8448->8445 8449->8445 8450->8445 8451->8445 8453 a6f6d5 ___scrt_uninitialize_crt LeaveCriticalSection 8452->8453 8454 a717cd 8453->8454 8454->8424 8456 a70e3e __FrameHandler3::FrameUnwindToState 8455->8456 8468 a6f6b2 EnterCriticalSection 8456->8468 8458 a70e4d 8459 a70e92 8458->8459 8469 a6f789 8458->8469 8461 a6baa8 ___free_lconv_mon 14 API calls 8459->8461 8463 a70e99 8461->8463 8462 a70e79 FlushFileBuffers 8462->8463 8464 a70e85 GetLastError 8462->8464 8485 a70ec8 8463->8485 8482 a6ba95 8464->8482 8468->8458 8470 a6f796 8469->8470 8471 a6f7ab 8469->8471 8472 a6ba95 ___scrt_uninitialize_crt 14 API calls 8470->8472 8473 a6ba95 ___scrt_uninitialize_crt 14 API calls 8471->8473 8475 a6f7d0 8471->8475 8474 a6f79b 8472->8474 8476 a6f7db 8473->8476 8477 a6baa8 ___free_lconv_mon 14 API calls 8474->8477 8475->8462 8478 a6baa8 ___free_lconv_mon 14 API calls 8476->8478 8479 a6f7a3 8477->8479 8480 a6f7e3 8478->8480 8479->8462 8481 a6b9ea ___std_exception_copy 41 API calls 8480->8481 8481->8479 8483 a6d341 __CreateFrameInfo 14 API calls 8482->8483 8484 a6ba9a 8483->8484 8484->8459 8486 a6f6d5 ___scrt_uninitialize_crt LeaveCriticalSection 8485->8486 8487 a70eb1 8486->8487 8487->8410 8488->8389 8489->8372 9075 a6cb85 9078 a6cb0c 9075->9078 9079 a6cb18 __FrameHandler3::FrameUnwindToState 9078->9079 9086 a6d5f2 EnterCriticalSection 9079->9086 9081 a6cb50 9087 a6cb6e 9081->9087 9082 a6cb22 9082->9081 9084 a6ff88 ___scrt_uninitialize_crt 14 API calls 9082->9084 9084->9082 9086->9082 9090 a6d63a LeaveCriticalSection 9087->9090 9089 a6cb5c 9090->9089 9840 a6f417 9841 a6f346 ___scrt_uninitialize_crt 70 API calls 9840->9841 9842 a6f41f 9841->9842 9850 a71a07 9842->9850 9844 a6f424 9860 a71ab2 9844->9860 9847 a6f44e 9848 a6d4db ___free_lconv_mon 14 API calls 9847->9848 9849 a6f459 9848->9849 9851 a71a13 __FrameHandler3::FrameUnwindToState 9850->9851 9864 a6d5f2 EnterCriticalSection 9851->9864 9853 a71a1e 9854 a71a8a 9853->9854 9857 a71a5e DeleteCriticalSection 9853->9857 9865 a72053 9853->9865 9871 a71aa9 9854->9871 9859 a6d4db ___free_lconv_mon 14 API calls 9857->9859 9859->9853 9861 a71ac9 9860->9861 9863 a6f433 DeleteCriticalSection 9860->9863 9862 a6d4db ___free_lconv_mon 14 API calls 9861->9862 9861->9863 9862->9863 9863->9844 9863->9847 9864->9853 9866 a72066 ___std_exception_copy 9865->9866 9874 a71f2e 9866->9874 9868 a72072 9869 a6b726 ___std_exception_copy 41 API calls 9868->9869 9870 a7207e 9869->9870 9870->9853 9946 a6d63a LeaveCriticalSection 9871->9946 9873 a71a96 9873->9844 9875 a71f3a __FrameHandler3::FrameUnwindToState 9874->9875 9876 a71f44 9875->9876 9878 a71f67 9875->9878 9877 a6b96d ___std_exception_copy 41 API calls 9876->9877 9884 a71f5f 9877->9884 9878->9884 9885 a6f463 EnterCriticalSection 9878->9885 9880 a71f85 9886 a71fc5 9880->9886 9882 a71f92 9900 a71fbd 9882->9900 9884->9868 9885->9880 9887 a71ff5 9886->9887 9888 a71fd2 9886->9888 9890 a6f278 ___scrt_uninitialize_crt 66 API calls 9887->9890 9898 a71fed 9887->9898 9889 a6b96d ___std_exception_copy 41 API calls 9888->9889 9889->9898 9891 a7200d 9890->9891 9892 a71ab2 14 API calls 9891->9892 9893 a72015 9892->9893 9894 a7060d ___scrt_uninitialize_crt 41 API calls 9893->9894 9895 a72021 9894->9895 9903 a7284c 9895->9903 9898->9882 9899 a6d4db ___free_lconv_mon 14 API calls 9899->9898 9945 a6f477 LeaveCriticalSection 9900->9945 9902 a71fc3 9902->9884 9905 a72875 9903->9905 9909 a72028 9903->9909 9904 a728c4 9906 a6b96d ___std_exception_copy 41 API calls 9904->9906 9905->9904 9907 a7289c 9905->9907 9906->9909 9910 a727bb 9907->9910 9909->9898 9909->9899 9911 a727c7 __FrameHandler3::FrameUnwindToState 9910->9911 9918 a6f6b2 EnterCriticalSection 9911->9918 9913 a727d5 9914 a72806 9913->9914 9919 a728ef 9913->9919 9932 a72840 9914->9932 9918->9913 9920 a6f789 ___scrt_uninitialize_crt 41 API calls 9919->9920 9923 a728ff 9920->9923 9921 a72905 9935 a6f6f8 9921->9935 9923->9921 9924 a6f789 ___scrt_uninitialize_crt 41 API calls 9923->9924 9931 a72937 9923->9931 9927 a7292e 9924->9927 9925 a6f789 ___scrt_uninitialize_crt 41 API calls 9926 a72943 CloseHandle 9925->9926 9926->9921 9928 a7294f GetLastError 9926->9928 9929 a6f789 ___scrt_uninitialize_crt 41 API calls 9927->9929 9928->9921 9929->9931 9930 a7295d ___scrt_uninitialize_crt 9930->9914 9931->9921 9931->9925 9944 a6f6d5 LeaveCriticalSection 9932->9944 9934 a72829 9934->9909 9936 a6f76e 9935->9936 9939 a6f707 9935->9939 9937 a6baa8 ___free_lconv_mon 14 API calls 9936->9937 9938 a6f773 9937->9938 9940 a6ba95 ___scrt_uninitialize_crt 14 API calls 9938->9940 9939->9936 9943 a6f731 9939->9943 9941 a6f75e 9940->9941 9941->9930 9942 a6f758 SetStdHandle 9942->9941 9943->9941 9943->9942 9944->9934 9945->9902 9946->9873 9146 a6a393 9149 a6ab8e 9146->9149 9150 a6ab9c ___except_validate_context_record 9149->9150 9158 a69ad4 9150->9158 9152 a6aba2 9153 a6abe1 9152->9153 9154 a6ac07 9152->9154 9157 a6a3b9 9152->9157 9153->9157 9171 a6af99 9153->9171 9154->9157 9174 a6a620 9154->9174 9224 a69ae2 9158->9224 9160 a69ad9 9160->9152 9238 a6ee63 9160->9238 9163 a6ccf5 9165 a6ccff IsProcessorFeaturePresent 9163->9165 9170 a6cd1e 9163->9170 9166 a6cd0b 9165->9166 9169 a6b7ee __CreateFrameInfo 8 API calls 9166->9169 9167 a6bf79 __CreateFrameInfo 23 API calls 9168 a6cd28 9167->9168 9169->9170 9170->9167 9291 a6afb1 9171->9291 9173 a6afac 9173->9157 9179 a6a640 __FrameHandler3::FrameUnwindToState 9174->9179 9175 a6a958 9176 a6cce5 __FrameHandler3::FrameUnwindToState 41 API calls 9175->9176 9187 a6a95e 9175->9187 9177 a6a9c9 9176->9177 9178 a6a92d 9178->9175 9181 a6a92b 9178->9181 9325 a6a9ca 9178->9325 9179->9175 9180 a6a722 9179->9180 9182 a69ad4 __CreateFrameInfo 51 API calls 9179->9182 9180->9178 9183 a6a7ab 9180->9183 9222 a6a728 type_info::operator== 9180->9222 9184 a69ad4 __CreateFrameInfo 51 API calls 9181->9184 9186 a6a6a2 9182->9186 9190 a6a8c3 CallCatchBlock 9183->9190 9310 a6a013 9183->9310 9184->9175 9186->9187 9189 a69ad4 __CreateFrameInfo 51 API calls 9186->9189 9187->9157 9191 a6a6b0 9189->9191 9190->9181 9192 a6a907 9190->9192 9193 a6a91c 9190->9193 9194 a69ad4 __CreateFrameInfo 51 API calls 9191->9194 9195 a69ad4 __CreateFrameInfo 51 API calls 9192->9195 9196 a6b099 IsInExceptionSpec 41 API calls 9193->9196 9201 a6a6b8 9194->9201 9197 a6a90c 9195->9197 9198 a6a925 9196->9198 9199 a69ad4 __CreateFrameInfo 51 API calls 9197->9199 9198->9181 9200 a6a988 9198->9200 9199->9222 9203 a69ad4 __CreateFrameInfo 51 API calls 9200->9203 9201->9175 9202 a69ad4 __CreateFrameInfo 51 API calls 9201->9202 9205 a6a701 9202->9205 9204 a6a98d 9203->9204 9206 a69ad4 __CreateFrameInfo 51 API calls 9204->9206 9205->9180 9209 a69ad4 __CreateFrameInfo 51 API calls 9205->9209 9210 a6a995 9206->9210 9208 a6a7cc ___TypeMatch 9208->9190 9315 a6a5a0 9208->9315 9211 a6a70b 9209->9211 9351 a6a206 RtlUnwind 9210->9351 9212 a69ad4 __CreateFrameInfo 51 API calls 9211->9212 9215 a6a716 9212->9215 9305 a6b099 9215->9305 9216 a6a9a9 9219 a6af99 __InternalCxxFrameHandler 51 API calls 9216->9219 9217 a6a968 __InternalCxxFrameHandler CallCatchBlock 9348 a6b286 9217->9348 9220 a6a9b5 __InternalCxxFrameHandler 9219->9220 9352 a6af10 9220->9352 9222->9217 9342 a6cc4a 9222->9342 9225 a69aee GetLastError 9224->9225 9226 a69aeb 9224->9226 9268 a69f20 9225->9268 9226->9160 9229 a69b68 SetLastError 9229->9160 9230 a69f5b ___vcrt_FlsSetValue 6 API calls 9231 a69b1c __CreateFrameInfo 9230->9231 9232 a69b44 9231->9232 9234 a69f5b ___vcrt_FlsSetValue 6 API calls 9231->9234 9237 a69b22 9231->9237 9233 a69f5b ___vcrt_FlsSetValue 6 API calls 9232->9233 9235 a69b58 9232->9235 9233->9235 9234->9232 9236 a6babb ___std_exception_destroy 14 API calls 9235->9236 9236->9237 9237->9229 9273 a6ed95 9238->9273 9241 a6eea8 9242 a6eeb4 __FrameHandler3::FrameUnwindToState 9241->9242 9243 a6eedb __CreateFrameInfo 9242->9243 9244 a6d341 __CreateFrameInfo 14 API calls 9242->9244 9247 a6eee1 __CreateFrameInfo 9242->9247 9245 a6ef28 9243->9245 9243->9247 9267 a6ef12 9243->9267 9244->9243 9246 a6baa8 ___free_lconv_mon 14 API calls 9245->9246 9248 a6ef2d 9246->9248 9250 a6ef54 9247->9250 9284 a6d5f2 EnterCriticalSection 9247->9284 9249 a6b9ea ___std_exception_copy 41 API calls 9248->9249 9249->9267 9253 a6ef96 9250->9253 9254 a6f087 9250->9254 9264 a6efc5 9250->9264 9259 a6d1f0 _unexpected 41 API calls 9253->9259 9253->9264 9255 a6f092 9254->9255 9289 a6d63a LeaveCriticalSection 9254->9289 9258 a6bf79 __CreateFrameInfo 23 API calls 9255->9258 9260 a6f09a 9258->9260 9262 a6efba 9259->9262 9261 a6d1f0 _unexpected 41 API calls 9265 a6f01a 9261->9265 9263 a6d1f0 _unexpected 41 API calls 9262->9263 9263->9264 9285 a6f034 9264->9285 9266 a6d1f0 _unexpected 41 API calls 9265->9266 9265->9267 9266->9267 9267->9163 9269 a69e61 ___vcrt_InitializeCriticalSectionEx 5 API calls 9268->9269 9270 a69f3a 9269->9270 9271 a69f52 TlsGetValue 9270->9271 9272 a69b03 9270->9272 9271->9272 9272->9229 9272->9230 9272->9237 9274 a6eda1 __FrameHandler3::FrameUnwindToState 9273->9274 9279 a6d5f2 EnterCriticalSection 9274->9279 9276 a6edaf 9280 a6eded 9276->9280 9279->9276 9283 a6d63a LeaveCriticalSection 9280->9283 9282 a6ccea 9282->9163 9282->9241 9283->9282 9284->9250 9286 a6f00b 9285->9286 9287 a6f03a 9285->9287 9286->9261 9286->9265 9286->9267 9290 a6d63a LeaveCriticalSection 9287->9290 9289->9255 9290->9286 9292 a6afbd __FrameHandler3::FrameUnwindToState 9291->9292 9293 a69ad4 __CreateFrameInfo 51 API calls 9292->9293 9297 a6afd8 __CallSettingFrame@12 __FrameHandler3::FrameUnwindToState 9293->9297 9295 a6b058 9296 a6cce5 __FrameHandler3::FrameUnwindToState 41 API calls 9295->9296 9299 a6b05d __FrameHandler3::FrameUnwindToState 9295->9299 9298 a6b098 9296->9298 9297->9295 9300 a6b07f 9297->9300 9299->9173 9301 a69ad4 __CreateFrameInfo 51 API calls 9300->9301 9302 a6b084 9301->9302 9303 a6b08f 9302->9303 9304 a69ad4 __CreateFrameInfo 51 API calls 9302->9304 9303->9295 9304->9303 9306 a6b12d 9305->9306 9309 a6b0ad ___TypeMatch 9305->9309 9307 a6cce5 __FrameHandler3::FrameUnwindToState 41 API calls 9306->9307 9308 a6b132 9307->9308 9309->9180 9311 a6a031 9310->9311 9312 a6cce5 __FrameHandler3::FrameUnwindToState 41 API calls 9311->9312 9313 a6a067 9311->9313 9314 a6a082 9312->9314 9313->9208 9316 a6a5bf 9315->9316 9317 a6a5b2 9315->9317 9368 a6a206 RtlUnwind 9316->9368 9364 a6a507 9317->9364 9320 a6a5d4 9321 a6afb1 __FrameHandler3::FrameUnwindToState 51 API calls 9320->9321 9322 a6a5e5 __FrameHandler3::FrameUnwindToState 9321->9322 9369 a6ad4c 9322->9369 9324 a6a60d __InternalCxxFrameHandler 9324->9208 9326 a6a9e0 9325->9326 9336 a6aaf5 9325->9336 9327 a69ad4 __CreateFrameInfo 51 API calls 9326->9327 9328 a6a9e7 9327->9328 9329 a6a9ee EncodePointer 9328->9329 9339 a6aa29 9328->9339 9332 a69ad4 __CreateFrameInfo 51 API calls 9329->9332 9330 a6aa46 9334 a6a013 __InternalCxxFrameHandler 41 API calls 9330->9334 9331 a6aafa 9333 a6cce5 __FrameHandler3::FrameUnwindToState 41 API calls 9331->9333 9337 a6a9fc 9332->9337 9335 a6aaff 9333->9335 9340 a6aa5d 9334->9340 9336->9181 9338 a6a0e0 CallCatchBlock 51 API calls 9337->9338 9337->9339 9338->9339 9339->9330 9339->9331 9339->9336 9340->9336 9341 a6a5a0 __InternalCxxFrameHandler 53 API calls 9340->9341 9341->9340 9343 a6cc56 __FrameHandler3::FrameUnwindToState 9342->9343 9344 a6d1f0 _unexpected 41 API calls 9343->9344 9347 a6cc5b 9344->9347 9345 a6cce5 __FrameHandler3::FrameUnwindToState 41 API calls 9346 a6cc85 9345->9346 9347->9345 9349 a6b2a0 9348->9349 9350 a6b2cd RaiseException 9348->9350 9349->9350 9350->9200 9351->9216 9353 a6af1c __EH_prolog3_catch 9352->9353 9354 a69ad4 __CreateFrameInfo 51 API calls 9353->9354 9355 a6af21 9354->9355 9356 a6af44 9355->9356 9428 a6b1bc 9355->9428 9358 a6cce5 __FrameHandler3::FrameUnwindToState 41 API calls 9356->9358 9360 a6af49 9358->9360 9365 a6a513 __FrameHandler3::FrameUnwindToState 9364->9365 9383 a6a3c9 9365->9383 9367 a6a53b __InternalCxxFrameHandler ___AdjustPointer 9367->9316 9368->9320 9370 a6ad58 __FrameHandler3::FrameUnwindToState 9369->9370 9387 a6a28a 9370->9387 9373 a69ad4 __CreateFrameInfo 51 API calls 9374 a6ad84 9373->9374 9375 a69ad4 __CreateFrameInfo 51 API calls 9374->9375 9376 a6ad8f 9375->9376 9377 a69ad4 __CreateFrameInfo 51 API calls 9376->9377 9378 a6ad9a 9377->9378 9379 a69ad4 __CreateFrameInfo 51 API calls 9378->9379 9380 a6ada2 CallCatchBlock 9379->9380 9392 a6ae94 9380->9392 9382 a6ae7c 9382->9324 9386 a6a3d5 __InternalCxxFrameHandler __FrameHandler3::FrameUnwindToState ___AdjustPointer 9383->9386 9384 a6cce5 __FrameHandler3::FrameUnwindToState 41 API calls 9385 a6a506 9384->9385 9386->9367 9386->9384 9388 a69ad4 __CreateFrameInfo 51 API calls 9387->9388 9389 a6a29b 9388->9389 9390 a69ad4 __CreateFrameInfo 51 API calls 9389->9390 9391 a6a2a6 9390->9391 9391->9373 9401 a6a2ae 9392->9401 9394 a6aea5 9395 a69ad4 __CreateFrameInfo 51 API calls 9394->9395 9396 a6aeab 9395->9396 9397 a69ad4 __CreateFrameInfo 51 API calls 9396->9397 9399 a6aeb6 9397->9399 9398 a6aef7 CallCatchBlock 9398->9382 9399->9398 9420 a699c4 9399->9420 9402 a69ad4 __CreateFrameInfo 51 API calls 9401->9402 9403 a6a2b7 9402->9403 9404 a6a2bf 9403->9404 9405 a6a2cd 9403->9405 9406 a69ad4 __CreateFrameInfo 51 API calls 9404->9406 9407 a69ad4 __CreateFrameInfo 51 API calls 9405->9407 9408 a6a2c7 9406->9408 9409 a6a2d2 9407->9409 9408->9394 9409->9408 9410 a6cce5 __FrameHandler3::FrameUnwindToState 41 API calls 9409->9410 9411 a6a2f5 9410->9411 9412 a673a8 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 9411->9412 9413 a6a30a 9412->9413 9414 a6a315 9413->9414 9415 a6ab8e __InternalCxxFrameHandler 54 API calls 9413->9415 9414->9394 9416 a6a34d 9415->9416 9417 a6a364 9416->9417 9423 a6a206 RtlUnwind 9416->9423 9424 a6a0e0 9417->9424 9421 a69ad4 __CreateFrameInfo 51 API calls 9420->9421 9422 a699cc 9421->9422 9422->9398 9423->9417 9425 a6a102 CallCatchBlock 9424->9425 9426 a6a0f0 9424->9426 9427 a69ad4 __CreateFrameInfo 51 API calls 9425->9427 9426->9414 9427->9426 9429 a69ad4 __CreateFrameInfo 51 API calls 9428->9429 9430 a6b1c2 9429->9430 9431 a6cc4a _unexpected 41 API calls 9430->9431 9432 a6b1d8 9431->9432

                                                                                                                                                                Executed Functions

                                                                                                                                                                Function 00A66BD8 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 61libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories), ref: 00A66BE6
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000), ref: 00A66BED
                                                                                                                                                                • LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 00A66C2C
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,DllEntry), ref: 00A66C47
                                                                                                                                                                • GetCommandLineW.KERNEL32(?), ref: 00A66C56
                                                                                                                                                                • FreeLibrary.KERNEL32(00000000), ref: 00A66C69
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2900711270.0000000000A61000.00000020.00000001.01000000.00000019.sdmp, Offset: 00A60000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2900679909.0000000000A60000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900753818.0000000000A75000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900788633.0000000000A77000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_a60000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressLibraryProc$CommandFreeHandleLineLoadModule
                                                                                                                                                                • String ID: DllEntry$SetDefaultDllDirectories$kernel32.dll
                                                                                                                                                                • API String ID: 1042781669-3472957018
                                                                                                                                                                • Opcode ID: ca25cc138fd85c98588ea096aa544e332d20ec236ae8e77046fca6c26c0079d0
                                                                                                                                                                • Instruction ID: ed8fad638ccea3920770640f489a9466c82e848835885b739307b25cd8546187
                                                                                                                                                                • Opcode Fuzzy Hash: ca25cc138fd85c98588ea096aa544e332d20ec236ae8e77046fca6c26c0079d0
                                                                                                                                                                • Instruction Fuzzy Hash: D5110432A4061ABFC711E7F4DD5AE6E7778EB05B90F104420F842F7290DE249D029760
                                                                                                                                                                Function 00A6BE77 Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                • GetCurrentProcess.KERNEL32(?,?,00A6BE71,?,00A6B7ED,?,?,E6B9901F,00A6B7ED,?), ref: 00A6BE88
                                                                                                                                                                • TerminateProcess.KERNEL32(00000000,?,00A6BE71,?,00A6B7ED,?,?,E6B9901F,00A6B7ED,?), ref: 00A6BE8F
                                                                                                                                                                • ExitProcess.KERNEL32 ref: 00A6BEA1
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2900711270.0000000000A61000.00000020.00000001.01000000.00000019.sdmp, Offset: 00A60000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2900679909.0000000000A60000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900753818.0000000000A75000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900788633.0000000000A77000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_a60000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Process$CurrentExitTerminate
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1703294689-0
                                                                                                                                                                • Opcode ID: be623cd07f098e4934fbbcbe47e752f245f2ceb466c4bb87b7d477ade0829c3f
                                                                                                                                                                • Instruction ID: e6e5f675fd728c0dce7e475e6b5b884f961b297dfceb14c3287ee623865b163d
                                                                                                                                                                • Opcode Fuzzy Hash: be623cd07f098e4934fbbcbe47e752f245f2ceb466c4bb87b7d477ade0829c3f
                                                                                                                                                                • Instruction Fuzzy Hash: 1CD09E31014244AFCF017FA0DD0D99D3F3AFF403417048014FA0D89035DB329AD39AA1
                                                                                                                                                                Function 00A66841 Relevance: 3.1, APIs: 2, Instructions: 122COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,00000104), ref: 00A66873
                                                                                                                                                                • SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,00000000,00000104,?,?,00000000), ref: 00A66936
                                                                                                                                                                  • Part of subcall function 00A66F37: FindResourceExW.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,?,00000000,?,?,00A668CC,-00000010), ref: 00A66F68
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2900711270.0000000000A61000.00000020.00000001.01000000.00000019.sdmp, Offset: 00A60000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2900679909.0000000000A60000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900753818.0000000000A75000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900788633.0000000000A77000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_a60000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileFindFolderModuleNamePathResource
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2248019921-0
                                                                                                                                                                • Opcode ID: 58fcf9c9f5e3b79790945f24e0f1499c5742e8f16e497e77e92336a113dc279d
                                                                                                                                                                • Instruction ID: bf76c39991b2c8c04a1de09ab44189854557878c93740e6647475befbb860895
                                                                                                                                                                • Opcode Fuzzy Hash: 58fcf9c9f5e3b79790945f24e0f1499c5742e8f16e497e77e92336a113dc279d
                                                                                                                                                                • Instruction Fuzzy Hash: BB416DB2D00519ABCB14EFB5DE959EEB7B8EF40300F144169E951A7291EF349F05CB90
                                                                                                                                                                Function 00A6D682 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 87 a6d682-a6d68d 88 a6d68f-a6d699 87->88 89 a6d69b-a6d6a1 87->89 88->89 90 a6d6cf-a6d6da call a6baa8 88->90 91 a6d6a3-a6d6a4 89->91 92 a6d6ba-a6d6cb RtlAllocateHeap 89->92 96 a6d6dc-a6d6de 90->96 91->92 93 a6d6a6-a6d6ad call a6cc0e 92->93 94 a6d6cd 92->94 93->90 100 a6d6af-a6d6b8 call a6ed0c 93->100 94->96 100->90 100->92
                                                                                                                                                                APIs
                                                                                                                                                                • RtlAllocateHeap.NTDLL(00000008,?,?,?,00A6D38E,00000001,00000364,?,00000006,000000FF,?,00A6BB1F,00000000,00A6C86A,00000004), ref: 00A6D6C3
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2900711270.0000000000A61000.00000020.00000001.01000000.00000019.sdmp, Offset: 00A60000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2900679909.0000000000A60000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900753818.0000000000A75000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900788633.0000000000A77000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_a60000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocateHeap
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1279760036-0
                                                                                                                                                                • Opcode ID: 6819249e9328823931b06f85b342cf86b0e2ae27156914b1bf18981e43bd5ab8
                                                                                                                                                                • Instruction ID: a5be3bc17199416e858b8b60bf426b8a47bfde0718441890ff37b5601b842f54
                                                                                                                                                                • Opcode Fuzzy Hash: 6819249e9328823931b06f85b342cf86b0e2ae27156914b1bf18981e43bd5ab8
                                                                                                                                                                • Instruction Fuzzy Hash: 9DF0E93AF3152467DB215B66DC05F5B3778AF817F0B158011F81CEA0A4CA30DC0186E0

                                                                                                                                                                Non-executed Functions

                                                                                                                                                                Function 00A67B6A Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00A67B76
                                                                                                                                                                • IsDebuggerPresent.KERNEL32 ref: 00A67C42
                                                                                                                                                                • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00A67C62
                                                                                                                                                                • UnhandledExceptionFilter.KERNEL32(?), ref: 00A67C6C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2900711270.0000000000A61000.00000020.00000001.01000000.00000019.sdmp, Offset: 00A60000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2900679909.0000000000A60000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900753818.0000000000A75000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900788633.0000000000A77000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_a60000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 254469556-0
                                                                                                                                                                • Opcode ID: 66826a0d8703bb4521c69b32e7c224438be2d9eadc8f1c993a03d8d2d24cdbde
                                                                                                                                                                • Instruction ID: 2411f677b0a824bad689fd23d60acb8e2bb62f0045f26a4ca2b3e6463d2c2006
                                                                                                                                                                • Opcode Fuzzy Hash: 66826a0d8703bb4521c69b32e7c224438be2d9eadc8f1c993a03d8d2d24cdbde
                                                                                                                                                                • Instruction Fuzzy Hash: A7311675D05218DBDF21DFA4DD89BCDBBB8AF08304F1041AAE40DAB250EB709B898F45
                                                                                                                                                                Function 00A673DD Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 263 a673dd-a673fe InitializeCriticalSectionAndSpinCount GetModuleHandleW 264 a67400-a6740f GetModuleHandleW 263->264 265 a67411-a6742d GetProcAddress * 2 263->265 264->265 268 a67457-a67471 call a67b6a DeleteCriticalSection 264->268 266 a67441-a67455 CreateEventW 265->266 267 a6742f-a67431 265->267 266->268 270 a6743e-a67440 266->270 267->266 269 a67433-a67439 267->269 273 a67473-a67474 CloseHandle 268->273 274 a6747a 268->274 269->270 273->274
                                                                                                                                                                APIs
                                                                                                                                                                • InitializeCriticalSectionAndSpinCount.KERNEL32(00A7592C,00000FA0,?,?,00A673BB), ref: 00A673E9
                                                                                                                                                                • GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00A673BB), ref: 00A673F4
                                                                                                                                                                • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00A673BB), ref: 00A67405
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00A67417
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00A67425
                                                                                                                                                                • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00A673BB), ref: 00A67448
                                                                                                                                                                • DeleteCriticalSection.KERNEL32(00A7592C,00000007,?,?,00A673BB), ref: 00A67464
                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?,?,00A673BB), ref: 00A67474
                                                                                                                                                                Strings
                                                                                                                                                                • kernel32.dll, xrefs: 00A67400
                                                                                                                                                                • SleepConditionVariableCS, xrefs: 00A67411
                                                                                                                                                                • WakeAllConditionVariable, xrefs: 00A6741D
                                                                                                                                                                • api-ms-win-core-synch-l1-2-0.dll, xrefs: 00A673EF
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2900711270.0000000000A61000.00000020.00000001.01000000.00000019.sdmp, Offset: 00A60000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2900679909.0000000000A60000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900753818.0000000000A75000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900788633.0000000000A77000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_a60000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
                                                                                                                                                                • String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                                                                                                                                • API String ID: 2565136772-3242537097
                                                                                                                                                                • Opcode ID: 37891839564e6467650dd58444413ccd6baf5619a42b3821f0614270c82e2cd3
                                                                                                                                                                • Instruction ID: ab0ddee77b24a456b9c3dfb5696e0fa8b743f224100a619ee6ab90ac64f35fce
                                                                                                                                                                • Opcode Fuzzy Hash: 37891839564e6467650dd58444413ccd6baf5619a42b3821f0614270c82e2cd3
                                                                                                                                                                • Instruction Fuzzy Hash: A6017571E59721BBDB219BF5AC0DE1F3E78AB45B65B048420FA0DD2290DEA0C8838661
                                                                                                                                                                Function 00A6A620 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 275 a6a620-a6a64b call a6b1d9 278 a6a9c4-a6a9c9 call a6cce5 275->278 279 a6a651-a6a654 275->279 279->278 280 a6a65a-a6a663 279->280 282 a6a760-a6a766 280->282 283 a6a669-a6a66d 280->283 286 a6a76e-a6a77c 282->286 283->282 285 a6a673-a6a67a 283->285 289 a6a692-a6a697 285->289 290 a6a67c-a6a683 285->290 287 a6a782-a6a786 286->287 288 a6a92d-a6a930 286->288 287->288 291 a6a78c-a6a793 287->291 293 a6a932-a6a935 288->293 294 a6a953-a6a95c call a69ad4 288->294 289->282 295 a6a69d-a6a6a5 call a69ad4 289->295 290->289 292 a6a685-a6a68c 290->292 297 a6a795-a6a79c 291->297 298 a6a7ab-a6a7b1 291->298 292->282 292->289 293->278 300 a6a93b-a6a950 call a6a9ca 293->300 294->278 308 a6a95e-a6a962 294->308 295->308 309 a6a6ab-a6a6c4 call a69ad4 * 2 295->309 297->298 303 a6a79e-a6a7a5 297->303 305 a6a7b7-a6a7de call a6a013 298->305 306 a6a8c9-a6a8cd 298->306 300->294 303->288 303->298 305->306 320 a6a7e4-a6a7e7 305->320 311 a6a8cf-a6a8d8 call a698be 306->311 312 a6a8d9-a6a8e5 306->312 309->278 333 a6a6ca-a6a6d0 309->333 311->312 312->294 313 a6a8e7-a6a8eb 312->313 317 a6a8fd-a6a905 313->317 318 a6a8ed-a6a8f5 313->318 323 a6a907-a6a91a call a69ad4 * 2 317->323 324 a6a91c-a6a929 call a6b099 317->324 318->294 322 a6a8f7-a6a8fb 318->322 326 a6a7ea-a6a7ff 320->326 322->294 322->317 349 a6a963 call a6cc4a 323->349 340 a6a92b 324->340 341 a6a988-a6a99d call a69ad4 * 2 324->341 330 a6a805-a6a808 326->330 331 a6a8aa-a6a8bd 326->331 330->331 336 a6a80e-a6a816 330->336 331->326 334 a6a8c3-a6a8c6 331->334 338 a6a6d2-a6a6d6 333->338 339 a6a6fc-a6a704 call a69ad4 333->339 334->306 336->331 342 a6a81c-a6a830 336->342 338->339 344 a6a6d8-a6a6df 338->344 355 a6a706-a6a726 call a69ad4 * 2 call a6b099 339->355 356 a6a768-a6a76b 339->356 340->294 370 a6a9a2-a6a9bf call a6a206 call a6af99 call a6b156 call a6af10 341->370 371 a6a99f 341->371 345 a6a833-a6a843 342->345 350 a6a6f3-a6a6f6 344->350 351 a6a6e1-a6a6e8 344->351 352 a6a845-a6a858 call a6ab00 345->352 353 a6a86b-a6a878 345->353 366 a6a968-a6a983 call a698be call a6acab call a6b286 349->366 350->278 350->339 351->350 360 a6a6ea-a6a6f1 351->360 367 a6a87c-a6a8a4 call a6a5a0 352->367 368 a6a85a-a6a860 352->368 353->345 358 a6a87a 353->358 355->356 388 a6a728-a6a72d 355->388 356->286 365 a6a8a7 358->365 360->339 360->350 365->331 366->341 367->365 368->352 373 a6a862-a6a868 368->373 370->278 371->370 373->353 388->349 390 a6a733-a6a746 call a6ad00 388->390 390->366 395 a6a74c-a6a758 390->395 395->349 396 a6a75e 395->396 396->390
                                                                                                                                                                APIs
                                                                                                                                                                • IsInExceptionSpec.LIBVCRUNTIME ref: 00A6A71D
                                                                                                                                                                • type_info::operator==.LIBVCRUNTIME ref: 00A6A73F
                                                                                                                                                                • ___TypeMatch.LIBVCRUNTIME ref: 00A6A84E
                                                                                                                                                                • IsInExceptionSpec.LIBVCRUNTIME ref: 00A6A920
                                                                                                                                                                • _UnwindNestedFrames.LIBCMT ref: 00A6A9A4
                                                                                                                                                                • CallUnexpected.LIBVCRUNTIME ref: 00A6A9BF
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2900711270.0000000000A61000.00000020.00000001.01000000.00000019.sdmp, Offset: 00A60000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2900679909.0000000000A60000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900753818.0000000000A75000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900788633.0000000000A77000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_a60000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
                                                                                                                                                                • String ID: csm$csm$csm
                                                                                                                                                                • API String ID: 2123188842-393685449
                                                                                                                                                                • Opcode ID: bec5f37517c33a11055b33f51b66b9c53a65f3bd6ac8eda98fc90807b1d41ec2
                                                                                                                                                                • Instruction ID: 5c96efb60eff807cac219927b1190222d31e1db6103c14dd76d512d4f3172126
                                                                                                                                                                • Opcode Fuzzy Hash: bec5f37517c33a11055b33f51b66b9c53a65f3bd6ac8eda98fc90807b1d41ec2
                                                                                                                                                                • Instruction Fuzzy Hash: D4B15876C00209AFCF19DFA4C9819AEBBB5FF64310F158159E815BB252D331DA52CF92
                                                                                                                                                                Function 00A66A46 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 123COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 00A66A9B
                                                                                                                                                                • PathRemoveFileSpecW.SHLWAPI(?,?,?,00000104), ref: 00A66AB6
                                                                                                                                                                • PathAppendW.SHLWAPI(?,goopdate.dll,?,?,00000104), ref: 00A66AE5
                                                                                                                                                                  • Part of subcall function 00A667DA: GetLastError.KERNEL32(00A66AAA,?,?,00000104), ref: 00A667DA
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2900711270.0000000000A61000.00000020.00000001.01000000.00000019.sdmp, Offset: 00A60000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2900679909.0000000000A60000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900753818.0000000000A75000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900788633.0000000000A77000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_a60000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FilePath$AppendErrorLastModuleNameRemoveSpec
                                                                                                                                                                • String ID: goopdate.dll
                                                                                                                                                                • API String ID: 3739599460-235033069
                                                                                                                                                                • Opcode ID: 6b48dca227d9650a5b1f9d3735484782d23dfecae80cbade1663552074152182
                                                                                                                                                                • Instruction ID: a16e0a8331f5239914e7d3a70fa0fb7b5ab53b45c31a0a13d390a04f0767d863
                                                                                                                                                                • Opcode Fuzzy Hash: 6b48dca227d9650a5b1f9d3735484782d23dfecae80cbade1663552074152182
                                                                                                                                                                • Instruction Fuzzy Hash: 914161F190022CAADB20EB74DD45FDEB7BCAB44704F1085F5A509E3142EA309E898B64
                                                                                                                                                                Function 00A69760 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • _ValidateLocalCookies.LIBCMT ref: 00A69797
                                                                                                                                                                • ___except_validate_context_record.LIBVCRUNTIME ref: 00A6979F
                                                                                                                                                                • _ValidateLocalCookies.LIBCMT ref: 00A69828
                                                                                                                                                                • __IsNonwritableInCurrentImage.LIBCMT ref: 00A69853
                                                                                                                                                                • _ValidateLocalCookies.LIBCMT ref: 00A698A8
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2900711270.0000000000A61000.00000020.00000001.01000000.00000019.sdmp, Offset: 00A60000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2900679909.0000000000A60000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900753818.0000000000A75000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900788633.0000000000A77000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_a60000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                                                                • String ID: csm
                                                                                                                                                                • API String ID: 1170836740-1018135373
                                                                                                                                                                • Opcode ID: a96868dd7a466d56976344c1182a702bee8dbd31a1ff8caed8c9c51e47ca0fee
                                                                                                                                                                • Instruction ID: 17f2eee4ab5d300dc052ac70e27d0fd298969f54940a299c0b73906c3562f4a8
                                                                                                                                                                • Opcode Fuzzy Hash: a96868dd7a466d56976344c1182a702bee8dbd31a1ff8caed8c9c51e47ca0fee
                                                                                                                                                                • Instruction Fuzzy Hash: 80418E34A00219EFCF10DF68C884A9FBBB9BF46324F14C165E819AB392D771DA01CB91
                                                                                                                                                                Function 00A6E6A7 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • FreeLibrary.KERNEL32(00000000,?,00A6E7B4,00A6C86A,0000000C,?,00000000,00000000,?,00A6E90E,00000021,FlsSetValue,00A62924,00A6292C,?), ref: 00A6E768
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2900711270.0000000000A61000.00000020.00000001.01000000.00000019.sdmp, Offset: 00A60000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2900679909.0000000000A60000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900753818.0000000000A75000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900788633.0000000000A77000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_a60000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FreeLibrary
                                                                                                                                                                • String ID: api-ms-$ext-ms-
                                                                                                                                                                • API String ID: 3664257935-537541572
                                                                                                                                                                • Opcode ID: bd62651bac312d38c14be7d9e9e60d819ad8e5b6a92fca6740b836e27906f648
                                                                                                                                                                • Instruction ID: e4a7748dbd2f94e545ca5b116e2824812bb81d6ef211ca7a86a05f14e42d9ae4
                                                                                                                                                                • Opcode Fuzzy Hash: bd62651bac312d38c14be7d9e9e60d819ad8e5b6a92fca6740b836e27906f648
                                                                                                                                                                • Instruction Fuzzy Hash: 0F21B77AA41615A7CB31DBA4EC84F5E3778EF51760B254120E919E7290EB30EE02C6E0
                                                                                                                                                                Function 00A69AE2 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetLastError.KERNEL32(?,?,00A69AD9,00A69A6A,00A67D51), ref: 00A69AF0
                                                                                                                                                                • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00A69AFE
                                                                                                                                                                • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00A69B17
                                                                                                                                                                • SetLastError.KERNEL32(00000000,00A69AD9,00A69A6A,00A67D51), ref: 00A69B69
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2900711270.0000000000A61000.00000020.00000001.01000000.00000019.sdmp, Offset: 00A60000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2900679909.0000000000A60000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900753818.0000000000A75000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900788633.0000000000A77000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_a60000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLastValue___vcrt_
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3852720340-0
                                                                                                                                                                • Opcode ID: fa69350863a6a14db89ce4d39baa86c4dbcd371de35f7fe71789ff153b60e919
                                                                                                                                                                • Instruction ID: 8abfb82c5ddf956ac2641837d2b40ec37aa8124ae67e6c294a9851c4126f7c27
                                                                                                                                                                • Opcode Fuzzy Hash: fa69350863a6a14db89ce4d39baa86c4dbcd371de35f7fe71789ff153b60e919
                                                                                                                                                                • Instruction Fuzzy Hash: DB01F73261E7119EE62467F5BD95A6B267CFB11BB5720022DF518810E0EF714C439184
                                                                                                                                                                Function 00A69DC7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • FreeLibrary.KERNEL32(00000000,?,?,?,00A69E88,?,?,00A75CEC,00000000,?,00A69FB3,00000004,InitializeCriticalSectionEx,00A61C14,InitializeCriticalSectionEx,00000000), ref: 00A69E57
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2900711270.0000000000A61000.00000020.00000001.01000000.00000019.sdmp, Offset: 00A60000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2900679909.0000000000A60000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900753818.0000000000A75000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900788633.0000000000A77000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_a60000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FreeLibrary
                                                                                                                                                                • String ID: api-ms-
                                                                                                                                                                • API String ID: 3664257935-2084034818
                                                                                                                                                                • Opcode ID: 026aa3a8ca946f337de84d6d8de99b29a260e4f6c9b780b1793513e79dd3c3e6
                                                                                                                                                                • Instruction ID: 55fda5745db54ea84f8b657e3eaaf3a56f0f5d36d7d2a576bdb53285e8c7861d
                                                                                                                                                                • Opcode Fuzzy Hash: 026aa3a8ca946f337de84d6d8de99b29a260e4f6c9b780b1793513e79dd3c3e6
                                                                                                                                                                • Instruction Fuzzy Hash: C111A032A45725ABDF22CBA89C45B5F77BCAF02B70F254121E905EB2C0D671ED4286D0
                                                                                                                                                                Function 00A6BECA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,E6B9901F,?,?,00000000,00A74492,000000FF,?,00A6BE9D,?,?,00A6BE71,?), ref: 00A6BEFF
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00A6BF11
                                                                                                                                                                • FreeLibrary.KERNEL32(00000000,?,00000000,00A74492,000000FF,?,00A6BE9D,?,?,00A6BE71,?), ref: 00A6BF33
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2900711270.0000000000A61000.00000020.00000001.01000000.00000019.sdmp, Offset: 00A60000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2900679909.0000000000A60000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900753818.0000000000A75000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900788633.0000000000A77000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_a60000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                • API String ID: 4061214504-1276376045
                                                                                                                                                                • Opcode ID: 9ca477e5d42f0de24abcc05f4af5714105a02b825a8e16c0761dbe1f0e81eb2a
                                                                                                                                                                • Instruction ID: bf87718bf4021ac23a787434e4ef633f160c1c796290fafb440a1c18c791737d
                                                                                                                                                                • Opcode Fuzzy Hash: 9ca477e5d42f0de24abcc05f4af5714105a02b825a8e16c0761dbe1f0e81eb2a
                                                                                                                                                                • Instruction Fuzzy Hash: 0F014431914616EBDB158F90DC05BBEBBB8FB04711F048525A816A22A0DB759941CAA0
                                                                                                                                                                Function 00A70B70 Relevance: 7.7, APIs: 5, Instructions: 202COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __alloca_probe_16.LIBCMT ref: 00A70BF7
                                                                                                                                                                • __alloca_probe_16.LIBCMT ref: 00A70CB8
                                                                                                                                                                • __freea.LIBCMT ref: 00A70D1F
                                                                                                                                                                  • Part of subcall function 00A6FA79: HeapAlloc.KERNEL32(00000000,00000000,00A6C86A,?,00A6D55D,?,00000000,?,00A6BB1F,00000000,00A6C86A,00000004,?,00000000,?,00A6C664), ref: 00A6FAAB
                                                                                                                                                                • __freea.LIBCMT ref: 00A70D34
                                                                                                                                                                • __freea.LIBCMT ref: 00A70D44
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2900711270.0000000000A61000.00000020.00000001.01000000.00000019.sdmp, Offset: 00A60000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2900679909.0000000000A60000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900753818.0000000000A75000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900788633.0000000000A77000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_a60000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: __freea$__alloca_probe_16$AllocHeap
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1096550386-0
                                                                                                                                                                • Opcode ID: 6a0a9a55dc9893eb640cc776844b4d393cbb09731aa98284f3e0595079483edd
                                                                                                                                                                • Instruction ID: 0a13f43cc642255a84dc858eb42e44c838a2f8a70eb5214d3270b695b4b3c987
                                                                                                                                                                • Opcode Fuzzy Hash: 6a0a9a55dc9893eb640cc776844b4d393cbb09731aa98284f3e0595079483edd
                                                                                                                                                                • Instruction Fuzzy Hash: 0251917260020AEFEF219FA4DD81EBB76B9EF44354B15C529FC0CDB251E671DC5086A0
                                                                                                                                                                Function 00A70F51 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetConsoleOutputCP.KERNEL32(E6B9901F,?,00000000,?), ref: 00A70FB4
                                                                                                                                                                  • Part of subcall function 00A6E537: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00A70D15,?,00000000,-00000008), ref: 00A6E5E3
                                                                                                                                                                • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00A7120F
                                                                                                                                                                • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00A71257
                                                                                                                                                                • GetLastError.KERNEL32 ref: 00A712FA
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2900711270.0000000000A61000.00000020.00000001.01000000.00000019.sdmp, Offset: 00A60000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2900679909.0000000000A60000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900753818.0000000000A75000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900788633.0000000000A77000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_a60000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2112829910-0
                                                                                                                                                                • Opcode ID: 4c454cda4ad6010b6a0b74aff707ad9c70ee6732f2e63107970fe8679363c227
                                                                                                                                                                • Instruction ID: 23c997f30f9069d95de6f42d0cc89f6f25a497e26591e68d6e9701500c922e7a
                                                                                                                                                                • Opcode Fuzzy Hash: 4c454cda4ad6010b6a0b74aff707ad9c70ee6732f2e63107970fe8679363c227
                                                                                                                                                                • Instruction Fuzzy Hash: 87D137B5D042589FCB15CFE8DC81AEDBBF5FF09310F18852AE859EB251D630A942CB50
                                                                                                                                                                Function 00A6A3C9 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2900711270.0000000000A61000.00000020.00000001.01000000.00000019.sdmp, Offset: 00A60000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2900679909.0000000000A60000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900753818.0000000000A75000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900788633.0000000000A77000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_a60000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AdjustPointer
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1740715915-0
                                                                                                                                                                • Opcode ID: 6c05f17740685111cbc0c3d189d7ae5ae890c76171d2f2cc6a61f35f45cf2384
                                                                                                                                                                • Instruction ID: 91d69feae4bf9e54afb2150d81a72462765009777b4550540005660f1fbf0c79
                                                                                                                                                                • Opcode Fuzzy Hash: 6c05f17740685111cbc0c3d189d7ae5ae890c76171d2f2cc6a61f35f45cf2384
                                                                                                                                                                • Instruction Fuzzy Hash: D151DF72601202AFDB29DF14DD49B6A77B4FF24314F14412DE91AA72A1EB71EC81CF92
                                                                                                                                                                Function 00A72766 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,00A71F1A,?,00000001,?,?,?,00A7134E,?,?,00000000), ref: 00A7277D
                                                                                                                                                                • GetLastError.KERNEL32(?,00A71F1A,?,00000001,?,?,?,00A7134E,?,?,00000000,?,?,?,00A718D5,?), ref: 00A72789
                                                                                                                                                                  • Part of subcall function 00A7274F: CloseHandle.KERNEL32(FFFFFFFE,00A72799,?,00A71F1A,?,00000001,?,?,?,00A7134E,?,?,00000000,?,?), ref: 00A7275F
                                                                                                                                                                • ___initconout.LIBCMT ref: 00A72799
                                                                                                                                                                  • Part of subcall function 00A72711: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00A72740,00A71F07,?,?,00A7134E,?,?,00000000,?), ref: 00A72724
                                                                                                                                                                • WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,00A71F1A,?,00000001,?,?,?,00A7134E,?,?,00000000,?), ref: 00A727AE
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2900711270.0000000000A61000.00000020.00000001.01000000.00000019.sdmp, Offset: 00A60000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2900679909.0000000000A60000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900753818.0000000000A75000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900788633.0000000000A77000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_a60000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2744216297-0
                                                                                                                                                                • Opcode ID: 0a09fe22bd1f4c05acf0506ef971e67feeb2345222ea387a814cf6f8b0641fda
                                                                                                                                                                • Instruction ID: fe877fb0de1c45b7c931c85782ec94433cd9dd9f395d6465b6131ae87410378d
                                                                                                                                                                • Opcode Fuzzy Hash: 0a09fe22bd1f4c05acf0506ef971e67feeb2345222ea387a814cf6f8b0641fda
                                                                                                                                                                • Instruction Fuzzy Hash: CFF01C36401124BBCF22AFE1DD04A9D3F66FB083A0F40C020FE1C85130CA328861EB91
                                                                                                                                                                Function 00A6754D Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SleepConditionVariableCS.KERNELBASE(?,00A674EA,00000064), ref: 00A67570
                                                                                                                                                                • LeaveCriticalSection.KERNEL32(00A7592C,?,?,00A674EA,00000064,?,00A66648,00A764A0,?,?,00A66D99,?,00A66852), ref: 00A6757A
                                                                                                                                                                • WaitForSingleObjectEx.KERNEL32(?,00000000,?,00A674EA,00000064,?,00A66648,00A764A0,?,?,00A66D99,?,00A66852), ref: 00A6758B
                                                                                                                                                                • EnterCriticalSection.KERNEL32(00A7592C,?,00A674EA,00000064,?,00A66648,00A764A0,?,?,00A66D99,?,00A66852), ref: 00A67592
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2900711270.0000000000A61000.00000020.00000001.01000000.00000019.sdmp, Offset: 00A60000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2900679909.0000000000A60000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900753818.0000000000A75000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900788633.0000000000A77000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_a60000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3269011525-0
                                                                                                                                                                • Opcode ID: 6b15e3c07af0902e722f623188c234a93e93514b081bf020e1c9459c0928730c
                                                                                                                                                                • Instruction ID: 2a43666afe33a6c7f9d5d232113bb577c73feacd9203b83c4092bd1ee5093f80
                                                                                                                                                                • Opcode Fuzzy Hash: 6b15e3c07af0902e722f623188c234a93e93514b081bf020e1c9459c0928730c
                                                                                                                                                                • Instruction Fuzzy Hash: 0FE01232E45A24FBCB116FF0EC08A9E7F39FB09771B44C050F60D66160C6A159928BD5
                                                                                                                                                                Function 00A6A9CA Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00A6A9EF
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2900711270.0000000000A61000.00000020.00000001.01000000.00000019.sdmp, Offset: 00A60000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2900679909.0000000000A60000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900753818.0000000000A75000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900788633.0000000000A77000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_a60000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: EncodePointer
                                                                                                                                                                • String ID: MOC$RCC
                                                                                                                                                                • API String ID: 2118026453-2084237596
                                                                                                                                                                • Opcode ID: 07426cbbd33538892f9c41173f199505d24a2d5c9d42bfeaebf54fa6ca175398
                                                                                                                                                                • Instruction ID: ffd481184a3f5b2b9c3445d9f09224b31753fab60b69f4028301c14f672d1e40
                                                                                                                                                                • Opcode Fuzzy Hash: 07426cbbd33538892f9c41173f199505d24a2d5c9d42bfeaebf54fa6ca175398
                                                                                                                                                                • Instruction Fuzzy Hash: 54415772900209AFCF15DF98CE81AAEBBB5FF68344F14805AF905B7211D7359990DF52
                                                                                                                                                                Function 00A669A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RegOpenKeyExW.ADVAPI32(?,Software\AVG\Browser\Update\Clients\{1C89EF2F-A88E-4DE0-97FE-CB40C8E4FEEA},00000000,00020019,?,?,?), ref: 00A669CF
                                                                                                                                                                • SHQueryValueExW.SHLWAPI(?,00A65D08,00000000,?,00000000,?,00000032,?,?), ref: 00A66A12
                                                                                                                                                                Strings
                                                                                                                                                                • Software\AVG\Browser\Update\Clients\{1C89EF2F-A88E-4DE0-97FE-CB40C8E4FEEA}, xrefs: 00A669C1
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2900711270.0000000000A61000.00000020.00000001.01000000.00000019.sdmp, Offset: 00A60000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2900679909.0000000000A60000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900753818.0000000000A75000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900788633.0000000000A77000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_a60000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: OpenQueryValue
                                                                                                                                                                • String ID: Software\AVG\Browser\Update\Clients\{1C89EF2F-A88E-4DE0-97FE-CB40C8E4FEEA}
                                                                                                                                                                • API String ID: 4153817207-1120627182
                                                                                                                                                                • Opcode ID: 7d8321f9146f01a78c7251cd62f397f26653a58b444c9c0aa45c25ca4ca76ca4
                                                                                                                                                                • Instruction ID: 5f590219585d705bf9b35a90251744d465807811bef29d76640916be931d6f6d
                                                                                                                                                                • Opcode Fuzzy Hash: 7d8321f9146f01a78c7251cd62f397f26653a58b444c9c0aa45c25ca4ca76ca4
                                                                                                                                                                • Instruction Fuzzy Hash: AB1182B6D40229AADB20DFA98D069BFBBB8EF50760F108255B815F61D1D6348E40CAA0
                                                                                                                                                                Function 00A67290 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00A664D1: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,8007000E,?,-C000001E,00000001), ref: 00A664D6
                                                                                                                                                                  • Part of subcall function 00A664D1: GetLastError.KERNEL32(?,00000000,?,8007000E,?,-C000001E,00000001), ref: 00A664E0
                                                                                                                                                                • IsDebuggerPresent.KERNEL32(?,?,?,00A66446,?), ref: 00A672C3
                                                                                                                                                                • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00A66446,?), ref: 00A672D2
                                                                                                                                                                Strings
                                                                                                                                                                • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00A672CD
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2900711270.0000000000A61000.00000020.00000001.01000000.00000019.sdmp, Offset: 00A60000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2900679909.0000000000A60000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900753818.0000000000A75000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2900788633.0000000000A77000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_a60000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
                                                                                                                                                                • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                                                                                                • API String ID: 450123788-631824599
                                                                                                                                                                • Opcode ID: a7a69e7ccf12c7c4ad4d4666609c9c5b87c222e25f92b6855c0c8e196640f069
                                                                                                                                                                • Instruction ID: 23aff1f725d57a7eaeff5a59884e4a901dd864f8070c4e272599906544993370
                                                                                                                                                                • Opcode Fuzzy Hash: a7a69e7ccf12c7c4ad4d4666609c9c5b87c222e25f92b6855c0c8e196640f069
                                                                                                                                                                • Instruction Fuzzy Hash: DFE06D706087508FD360DF74EA1438A7AF4AB00749F00892CE49AC2641DBB0D489CB91

                                                                                                                                                                Execution Graph

                                                                                                                                                                Execution Coverage:3.9%
                                                                                                                                                                Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                Signature Coverage:0%
                                                                                                                                                                Total number of Nodes:1273
                                                                                                                                                                Total number of Limit Nodes:28
                                                                                                                                                                execution_graph 9172 7cb85 9175 7cb0c 9172->9175 9176 7cb18 __FrameHandler3::FrameUnwindToState 9175->9176 9183 7d5f2 EnterCriticalSection 9176->9183 9178 7cb22 9179 7cb50 9178->9179 9184 7ff88 9178->9184 9188 7cb6e 9179->9188 9183->9178 9185 7ff96 _unexpected 9184->9185 9187 7ffa3 9184->9187 9186 7fcbb _unexpected 14 API calls 9185->9186 9185->9187 9186->9187 9187->9178 9191 7d63a LeaveCriticalSection 9188->9191 9190 7cb5c 9191->9190 8584 77d0d 8585 77d44 8584->8585 8586 77d1f 8584->8586 8586->8585 8593 79a65 8586->8593 8605 79ad4 8593->8605 8595 77d51 8596 79a6e 8595->8596 8597 79ad4 __FrameHandler3::FrameUnwindToState 51 API calls 8596->8597 8598 77d5b 8597->8598 8599 7cc4a 8598->8599 8600 7cc56 __FrameHandler3::FrameUnwindToState 8599->8600 8601 7d1f0 _unexpected 41 API calls 8600->8601 8602 7cc5b 8601->8602 8603 7cce5 __FrameHandler3::FrameUnwindToState 41 API calls 8602->8603 8604 7cc85 8603->8604 8618 79ae2 8605->8618 8607 79ad9 8607->8595 8632 7ee63 8607->8632 8609 7ccf5 8612 7cd1e 8609->8612 8613 7ccff IsProcessorFeaturePresent 8609->8613 8614 7bf79 __FrameHandler3::FrameUnwindToState 23 API calls 8612->8614 8615 7cd0b 8613->8615 8617 7cd28 8614->8617 8616 7b7ee __FrameHandler3::FrameUnwindToState 8 API calls 8615->8616 8616->8612 8619 79aee GetLastError 8618->8619 8620 79aeb 8618->8620 8662 79f20 8619->8662 8620->8607 8623 79b22 8624 79b68 SetLastError 8623->8624 8624->8607 8625 79f5b ___vcrt_FlsSetValue 6 API calls 8626 79b1c __FrameHandler3::FrameUnwindToState 8625->8626 8626->8623 8627 79b44 8626->8627 8628 79f5b ___vcrt_FlsSetValue 6 API calls 8626->8628 8629 79f5b ___vcrt_FlsSetValue 6 API calls 8627->8629 8630 79b58 8627->8630 8628->8627 8629->8630 8631 7babb ___std_exception_destroy 14 API calls 8630->8631 8631->8623 8667 7ed95 8632->8667 8635 7eea8 8636 7eeb4 __FrameHandler3::FrameUnwindToState 8635->8636 8637 7d341 __FrameHandler3::FrameUnwindToState 14 API calls 8636->8637 8640 7eee1 __FrameHandler3::FrameUnwindToState 8636->8640 8644 7eedb __FrameHandler3::FrameUnwindToState 8636->8644 8637->8644 8638 7ef28 8639 7baa8 __freea 14 API calls 8638->8639 8641 7ef2d 8639->8641 8643 7ef54 8640->8643 8678 7d5f2 EnterCriticalSection 8640->8678 8642 7b9ea ___std_exception_copy 41 API calls 8641->8642 8661 7ef12 8642->8661 8647 7f087 8643->8647 8648 7ef96 8643->8648 8658 7efc5 8643->8658 8644->8638 8644->8640 8644->8661 8649 7f092 8647->8649 8683 7d63a LeaveCriticalSection 8647->8683 8653 7d1f0 _unexpected 41 API calls 8648->8653 8648->8658 8652 7bf79 __FrameHandler3::FrameUnwindToState 23 API calls 8649->8652 8654 7f09a 8652->8654 8655 7efba 8653->8655 8657 7d1f0 _unexpected 41 API calls 8655->8657 8656 7d1f0 _unexpected 41 API calls 8659 7f01a 8656->8659 8657->8658 8679 7f034 8658->8679 8660 7d1f0 _unexpected 41 API calls 8659->8660 8659->8661 8660->8661 8661->8609 8663 79e61 ___vcrt_FlsFree 5 API calls 8662->8663 8664 79f3a 8663->8664 8665 79f52 TlsGetValue 8664->8665 8666 79b03 8664->8666 8665->8666 8666->8623 8666->8624 8666->8625 8668 7eda1 __FrameHandler3::FrameUnwindToState 8667->8668 8673 7d5f2 EnterCriticalSection 8668->8673 8670 7edaf 8674 7eded 8670->8674 8673->8670 8677 7d63a LeaveCriticalSection 8674->8677 8676 7ccea 8676->8609 8676->8635 8677->8676 8678->8643 8680 7f03a 8679->8680 8682 7f00b 8679->8682 8684 7d63a LeaveCriticalSection 8680->8684 8682->8656 8682->8659 8682->8661 8683->8649 8684->8682 8685 7f417 8686 7f346 ___scrt_uninitialize_crt 70 API calls 8685->8686 8687 7f41f 8686->8687 8695 81a07 8687->8695 8689 7f424 8705 81ab2 8689->8705 8692 7f44e 8693 7d4db __freea 14 API calls 8692->8693 8694 7f459 8693->8694 8696 81a13 __FrameHandler3::FrameUnwindToState 8695->8696 8709 7d5f2 EnterCriticalSection 8696->8709 8698 81a1e 8699 81a8a 8698->8699 8702 81a5e DeleteCriticalSection 8698->8702 8710 82053 8698->8710 8716 81aa9 8699->8716 8704 7d4db __freea 14 API calls 8702->8704 8704->8698 8706 81ac9 8705->8706 8707 7f433 DeleteCriticalSection 8705->8707 8706->8707 8708 7d4db __freea 14 API calls 8706->8708 8707->8689 8707->8692 8708->8707 8709->8698 8711 82066 ___std_exception_copy 8710->8711 8719 81f2e 8711->8719 8713 82072 8714 7b726 ___std_exception_copy 41 API calls 8713->8714 8715 8207e 8714->8715 8715->8698 8791 7d63a LeaveCriticalSection 8716->8791 8718 81a96 8718->8689 8720 81f3a __FrameHandler3::FrameUnwindToState 8719->8720 8721 81f44 8720->8721 8722 81f67 8720->8722 8723 7b96d ___std_exception_copy 41 API calls 8721->8723 8729 81f5f 8722->8729 8730 7f463 EnterCriticalSection 8722->8730 8723->8729 8725 81f85 8731 81fc5 8725->8731 8727 81f92 8745 81fbd 8727->8745 8729->8713 8730->8725 8732 81fd2 8731->8732 8733 81ff5 8731->8733 8734 7b96d ___std_exception_copy 41 API calls 8732->8734 8735 7f278 ___scrt_uninitialize_crt 66 API calls 8733->8735 8743 81fed 8733->8743 8734->8743 8736 8200d 8735->8736 8737 81ab2 14 API calls 8736->8737 8738 82015 8737->8738 8739 8060d ___scrt_uninitialize_crt 41 API calls 8738->8739 8740 82021 8739->8740 8748 8284c 8740->8748 8743->8727 8744 7d4db __freea 14 API calls 8744->8743 8790 7f477 LeaveCriticalSection 8745->8790 8747 81fc3 8747->8729 8749 82028 8748->8749 8750 82875 8748->8750 8749->8743 8749->8744 8751 828c4 8750->8751 8753 8289c 8750->8753 8752 7b96d ___std_exception_copy 41 API calls 8751->8752 8752->8749 8755 827bb 8753->8755 8756 827c7 __FrameHandler3::FrameUnwindToState 8755->8756 8763 7f6b2 EnterCriticalSection 8756->8763 8758 82806 8777 82840 8758->8777 8759 827d5 8759->8758 8764 828ef 8759->8764 8763->8759 8765 7f789 ___scrt_uninitialize_crt 41 API calls 8764->8765 8767 828ff 8765->8767 8766 82905 8780 7f6f8 8766->8780 8767->8766 8769 7f789 ___scrt_uninitialize_crt 41 API calls 8767->8769 8776 82937 8767->8776 8771 8292e 8769->8771 8770 7f789 ___scrt_uninitialize_crt 41 API calls 8772 82943 CloseHandle 8770->8772 8774 7f789 ___scrt_uninitialize_crt 41 API calls 8771->8774 8772->8766 8775 8294f GetLastError 8772->8775 8773 8295d ___scrt_uninitialize_crt 8773->8758 8774->8776 8775->8766 8776->8766 8776->8770 8789 7f6d5 LeaveCriticalSection 8777->8789 8779 82829 8779->8749 8781 7f707 8780->8781 8782 7f76e 8780->8782 8781->8782 8787 7f731 8781->8787 8783 7baa8 __freea 14 API calls 8782->8783 8784 7f773 8783->8784 8785 7ba95 ___scrt_uninitialize_crt 14 API calls 8784->8785 8786 7f75e 8785->8786 8786->8773 8787->8786 8788 7f758 SetStdHandle 8787->8788 8788->8786 8789->8779 8790->8747 8791->8718 9374 80da7 9377 7e1be 9374->9377 9378 7e1c7 9377->9378 9382 7e1f9 9377->9382 9383 7d2ab 9378->9383 9384 7d2b6 9383->9384 9385 7d2bc 9383->9385 9386 7e8b3 _unexpected 6 API calls 9384->9386 9387 7e8f2 _unexpected 6 API calls 9385->9387 9405 7d2c2 9385->9405 9386->9385 9388 7d2d6 9387->9388 9389 7d682 _unexpected 14 API calls 9388->9389 9388->9405 9392 7d2e6 9389->9392 9390 7cce5 __FrameHandler3::FrameUnwindToState 41 API calls 9393 7d340 9390->9393 9391 7d2c7 9408 7dfc9 9391->9408 9394 7d303 9392->9394 9395 7d2ee 9392->9395 9396 7e8f2 _unexpected 6 API calls 9394->9396 9397 7e8f2 _unexpected 6 API calls 9395->9397 9398 7d30f 9396->9398 9399 7d2fa 9397->9399 9400 7d313 9398->9400 9401 7d322 9398->9401 9404 7d4db __freea 14 API calls 9399->9404 9402 7e8f2 _unexpected 6 API calls 9400->9402 9403 7d01e _unexpected 14 API calls 9401->9403 9402->9399 9406 7d32d 9403->9406 9404->9405 9405->9390 9405->9391 9407 7d4db __freea 14 API calls 9406->9407 9407->9391 9431 7e11e 9408->9431 9413 7e00c 9413->9382 9415 7e01d 9416 7e025 9415->9416 9417 7e033 9415->9417 9418 7d4db __freea 14 API calls 9416->9418 9456 7e219 9417->9456 9418->9413 9421 7e06b 9423 7baa8 __freea 14 API calls 9421->9423 9422 7e086 9425 7e0b2 9422->9425 9428 7d4db __freea 14 API calls 9422->9428 9424 7e070 9423->9424 9427 7d4db __freea 14 API calls 9424->9427 9426 7e0fb 9425->9426 9467 7dc3b 9425->9467 9430 7d4db __freea 14 API calls 9426->9430 9427->9413 9428->9425 9430->9413 9432 7e12a __FrameHandler3::FrameUnwindToState 9431->9432 9434 7e144 9432->9434 9475 7d5f2 EnterCriticalSection 9432->9475 9437 7cce5 __FrameHandler3::FrameUnwindToState 41 API calls 9434->9437 9438 7dff3 9434->9438 9435 7e180 9476 7e19d 9435->9476 9439 7e1bd 9437->9439 9442 7dd49 9438->9442 9440 7e154 9440->9435 9441 7d4db __freea 14 API calls 9440->9441 9441->9435 9480 7dad9 9442->9480 9445 7dd7c 9447 7dd81 GetACP 9445->9447 9448 7dd93 9445->9448 9446 7dd6a GetOEMCP 9446->9448 9447->9448 9448->9413 9449 7fa79 9448->9449 9450 7fab7 9449->9450 9454 7fa87 _unexpected 9449->9454 9452 7baa8 __freea 14 API calls 9450->9452 9451 7faa2 HeapAlloc 9453 7fab5 9451->9453 9451->9454 9452->9453 9453->9415 9454->9450 9454->9451 9455 7ed0c _unexpected 2 API calls 9454->9455 9455->9454 9457 7dd49 43 API calls 9456->9457 9458 7e239 9457->9458 9460 7e276 IsValidCodePage 9458->9460 9465 7e2b2 __FrameHandler3::FrameUnwindToState 9458->9465 9459 773a8 __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 9461 7e060 9459->9461 9462 7e288 9460->9462 9460->9465 9461->9421 9461->9422 9463 7e2b7 GetCPInfo 9462->9463 9466 7e291 __FrameHandler3::FrameUnwindToState 9462->9466 9463->9465 9463->9466 9465->9459 9519 7de1d 9466->9519 9468 7dc47 __FrameHandler3::FrameUnwindToState 9467->9468 9603 7d5f2 EnterCriticalSection 9468->9603 9470 7dc51 9604 7dc88 9470->9604 9475->9440 9479 7d63a LeaveCriticalSection 9476->9479 9478 7e1a4 9478->9434 9479->9478 9481 7daf0 9480->9481 9482 7daf9 9480->9482 9481->9445 9481->9446 9482->9481 9483 7d1f0 _unexpected 41 API calls 9482->9483 9484 7db19 9483->9484 9488 8041e 9484->9488 9489 7db2f 9488->9489 9490 80431 9488->9490 9492 8047c 9489->9492 9490->9489 9496 7ff07 9490->9496 9493 8048f 9492->9493 9495 804a4 9492->9495 9493->9495 9514 7e206 9493->9514 9495->9481 9497 7ff13 __FrameHandler3::FrameUnwindToState 9496->9497 9498 7d1f0 _unexpected 41 API calls 9497->9498 9499 7ff1c 9498->9499 9506 7ff62 9499->9506 9509 7d5f2 EnterCriticalSection 9499->9509 9501 7ff3a 9502 7ff88 ___scrt_uninitialize_crt 14 API calls 9501->9502 9503 7ff4b 9502->9503 9510 7ff67 9503->9510 9506->9489 9507 7cce5 __FrameHandler3::FrameUnwindToState 41 API calls 9508 7ff87 9507->9508 9509->9501 9513 7d63a LeaveCriticalSection 9510->9513 9512 7ff5e 9512->9506 9512->9507 9513->9512 9515 7d1f0 _unexpected 41 API calls 9514->9515 9516 7e20b 9515->9516 9517 7e11e ___scrt_uninitialize_crt 41 API calls 9516->9517 9518 7e216 9517->9518 9518->9495 9520 7de45 GetCPInfo 9519->9520 9529 7df0e 9519->9529 9526 7de5d 9520->9526 9520->9529 9521 773a8 __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 9524 7dfc7 9521->9524 9524->9465 9530 7fb15 9526->9530 9528 80d5e 45 API calls 9528->9529 9529->9521 9531 7dad9 41 API calls 9530->9531 9532 7fb35 9531->9532 9550 7e4bb 9532->9550 9534 7fbf9 9537 773a8 __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 9534->9537 9535 7fbf1 9553 7fc1e 9535->9553 9536 7fb62 9536->9534 9536->9535 9539 7fa79 15 API calls 9536->9539 9541 7fb87 __FrameHandler3::FrameUnwindToState __alloca_probe_16 9536->9541 9540 7dec5 9537->9540 9539->9541 9545 80d5e 9540->9545 9541->9535 9542 7e4bb ___scrt_uninitialize_crt MultiByteToWideChar 9541->9542 9543 7fbd2 9542->9543 9543->9535 9544 7fbdd GetStringTypeW 9543->9544 9544->9535 9546 7dad9 41 API calls 9545->9546 9547 80d71 9546->9547 9557 80b70 9547->9557 9551 7e4cc MultiByteToWideChar 9550->9551 9551->9536 9554 7fc3b 9553->9554 9555 7fc2a 9553->9555 9554->9534 9555->9554 9556 7d4db __freea 14 API calls 9555->9556 9556->9554 9558 80b8b 9557->9558 9559 7e4bb ___scrt_uninitialize_crt MultiByteToWideChar 9558->9559 9562 80bd1 9559->9562 9560 80d49 9561 773a8 __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 9560->9561 9563 7dee6 9561->9563 9562->9560 9564 7fa79 15 API calls 9562->9564 9566 80bf7 __alloca_probe_16 9562->9566 9577 80c7d 9562->9577 9563->9528 9564->9566 9565 7fc1e __freea 14 API calls 9565->9560 9567 7e4bb ___scrt_uninitialize_crt MultiByteToWideChar 9566->9567 9566->9577 9568 80c3c 9567->9568 9568->9577 9585 7e97f 9568->9585 9571 80c6e 9575 7e97f 6 API calls 9571->9575 9571->9577 9572 80ca6 9573 80d31 9572->9573 9576 7fa79 15 API calls 9572->9576 9578 80cb8 __alloca_probe_16 9572->9578 9574 7fc1e __freea 14 API calls 9573->9574 9574->9577 9575->9577 9576->9578 9577->9565 9578->9573 9579 7e97f 6 API calls 9578->9579 9580 80cfb 9579->9580 9580->9573 9591 7e537 9580->9591 9582 80d15 9582->9573 9583 80d1e 9582->9583 9584 7fc1e __freea 14 API calls 9583->9584 9584->9577 9594 7e673 9585->9594 9589 7e9d0 LCMapStringW 9590 7e990 9589->9590 9590->9571 9590->9572 9590->9577 9592 7e54e WideCharToMultiByte 9591->9592 9592->9582 9595 7e772 _unexpected 5 API calls 9594->9595 9596 7e689 9595->9596 9596->9590 9597 7e9dc 9596->9597 9600 7e68d 9597->9600 9599 7e9e7 9599->9589 9601 7e772 _unexpected 5 API calls 9600->9601 9602 7e6a3 9601->9602 9602->9599 9603->9470 9614 7e421 9604->9614 9606 7dcaa 9607 7e421 41 API calls 9606->9607 9608 7dcc9 9607->9608 9609 7d4db __freea 14 API calls 9608->9609 9610 7dc5e 9608->9610 9609->9610 9611 7dc7c 9610->9611 9628 7d63a LeaveCriticalSection 9611->9628 9613 7dc6a 9613->9426 9615 7e432 9614->9615 9624 7e42e __InternalCxxFrameHandler 9614->9624 9616 7e439 9615->9616 9619 7e44c __FrameHandler3::FrameUnwindToState 9615->9619 9617 7baa8 __freea 14 API calls 9616->9617 9618 7e43e 9617->9618 9620 7b9ea ___std_exception_copy 41 API calls 9618->9620 9621 7e483 9619->9621 9622 7e47a 9619->9622 9619->9624 9620->9624 9621->9624 9626 7baa8 __freea 14 API calls 9621->9626 9623 7baa8 __freea 14 API calls 9622->9623 9625 7e47f 9623->9625 9624->9606 9627 7b9ea ___std_exception_copy 41 API calls 9625->9627 9626->9625 9627->9624 9628->9613 9629 7d0b7 9630 7d0c2 9629->9630 9634 7d0d2 9629->9634 9635 7d0d8 9630->9635 9633 7d4db __freea 14 API calls 9633->9634 9636 7d0f3 9635->9636 9637 7d0ed 9635->9637 9639 7d4db __freea 14 API calls 9636->9639 9638 7d4db __freea 14 API calls 9637->9638 9638->9636 9640 7d0ff 9639->9640 9641 7d4db __freea 14 API calls 9640->9641 9642 7d10a 9641->9642 9643 7d4db __freea 14 API calls 9642->9643 9644 7d115 9643->9644 9645 7d4db __freea 14 API calls 9644->9645 9646 7d120 9645->9646 9647 7d4db __freea 14 API calls 9646->9647 9648 7d12b 9647->9648 9649 7d4db __freea 14 API calls 9648->9649 9650 7d136 9649->9650 9651 7d4db __freea 14 API calls 9650->9651 9652 7d141 9651->9652 9653 7d4db __freea 14 API calls 9652->9653 9654 7d14c 9653->9654 9655 7d4db __freea 14 API calls 9654->9655 9656 7d15a 9655->9656 9661 7cf04 9656->9661 9662 7cf10 __FrameHandler3::FrameUnwindToState 9661->9662 9677 7d5f2 EnterCriticalSection 9662->9677 9664 7cf44 9678 7cf63 9664->9678 9666 7cf1a 9666->9664 9668 7d4db __freea 14 API calls 9666->9668 9668->9664 9669 7cf6f 9670 7cf7b __FrameHandler3::FrameUnwindToState 9669->9670 9682 7d5f2 EnterCriticalSection 9670->9682 9672 7cf85 9673 7d1a5 _unexpected 14 API calls 9672->9673 9674 7cf98 9673->9674 9683 7cfb8 9674->9683 9677->9666 9681 7d63a LeaveCriticalSection 9678->9681 9680 7cf51 9680->9669 9681->9680 9682->9672 9686 7d63a LeaveCriticalSection 9683->9686 9685 7cfa6 9685->9633 9686->9685 7803 778bf 7804 778cb __FrameHandler3::FrameUnwindToState 7803->7804 7829 77611 7804->7829 7806 778d2 7807 77a25 7806->7807 7817 778fc ___scrt_is_nonwritable_in_current_image __FrameHandler3::FrameUnwindToState ___scrt_release_startup_lock 7806->7817 7877 77b6a IsProcessorFeaturePresent 7807->7877 7809 77a2c 7857 7bfb5 7809->7857 7814 7791b 7815 7799c 7837 77c85 7815->7837 7817->7814 7817->7815 7860 7bf8f 7817->7860 7818 779a2 7841 76bd8 GetModuleHandleW GetProcAddress 7818->7841 7821 779b7 7866 77cbe GetModuleHandleW 7821->7866 7824 779c2 7825 779cb 7824->7825 7868 7bf6a 7824->7868 7871 77782 7825->7871 7830 7761a 7829->7830 7884 77d6b IsProcessorFeaturePresent 7830->7884 7834 7762b 7835 7762f 7834->7835 7894 79709 7834->7894 7835->7806 7956 79590 7837->7956 7840 77cab 7840->7818 7842 76bf7 7841->7842 7958 76841 7842->7958 7844 76c06 7985 76d91 7844->7985 7846 76c10 7988 76a46 7846->7988 7849 76c25 LoadLibraryExW 7851 76c41 GetProcAddress 7849->7851 7852 76c38 7849->7852 7850 76c3d 7850->7821 7854 76c5f FreeLibrary 7851->7854 7855 76c53 GetCommandLineW 7851->7855 8019 767da GetLastError 7852->8019 7854->7850 7855->7854 8318 7bde0 7857->8318 7861 7bfa5 __FrameHandler3::FrameUnwindToState _unexpected 7860->7861 7861->7815 8393 7d1f0 GetLastError 7861->8393 7863 7cce5 __FrameHandler3::FrameUnwindToState 41 API calls 7864 7cc85 7863->7864 7867 779be 7866->7867 7867->7809 7867->7824 7869 7bde0 __FrameHandler3::FrameUnwindToState 23 API calls 7868->7869 7870 7bf75 7869->7870 7870->7825 7872 7778e 7871->7872 7873 777a4 7872->7873 8420 7c979 7872->8420 7873->7814 7875 7779c 7876 79709 ___scrt_uninitialize_crt 7 API calls 7875->7876 7876->7873 7878 77b80 __FrameHandler3::FrameUnwindToState 7877->7878 7879 77c2b IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 7878->7879 7880 77c76 __FrameHandler3::FrameUnwindToState 7879->7880 7880->7809 7881 7bf79 7882 7bde0 __FrameHandler3::FrameUnwindToState 23 API calls 7881->7882 7883 77a3a 7882->7883 7885 77626 7884->7885 7886 796ea 7885->7886 7900 79bc2 7886->7900 7889 796f3 7889->7834 7891 796fb 7892 79706 7891->7892 7914 79bfe 7891->7914 7892->7834 7895 79712 7894->7895 7896 7971c 7894->7896 7897 79ba7 ___vcrt_uninitialize_ptd 6 API calls 7895->7897 7896->7835 7898 79717 7897->7898 7899 79bfe ___vcrt_uninitialize_locks DeleteCriticalSection 7898->7899 7899->7896 7903 79bcb 7900->7903 7902 79bf4 7905 79bfe ___vcrt_uninitialize_locks DeleteCriticalSection 7902->7905 7903->7902 7904 796ef 7903->7904 7918 79f99 7903->7918 7904->7889 7906 79b74 7904->7906 7905->7904 7937 79eaa 7906->7937 7910 79ba4 7910->7891 7913 79b89 7913->7891 7915 79c28 7914->7915 7916 79c09 7914->7916 7915->7889 7917 79c13 DeleteCriticalSection 7916->7917 7917->7915 7917->7917 7923 79e61 7918->7923 7921 79fd1 InitializeCriticalSectionAndSpinCount 7922 79fbc 7921->7922 7922->7903 7924 79e79 7923->7924 7927 79e9c 7923->7927 7924->7927 7929 79dc7 7924->7929 7927->7921 7927->7922 7928 79e8e GetProcAddress 7928->7927 7935 79dd3 ___vcrt_FlsFree 7929->7935 7930 79e47 7930->7927 7930->7928 7931 79de9 LoadLibraryExW 7932 79e07 GetLastError 7931->7932 7933 79e4e 7931->7933 7932->7935 7933->7930 7934 79e56 FreeLibrary 7933->7934 7934->7930 7935->7930 7935->7931 7936 79e29 LoadLibraryExW 7935->7936 7936->7933 7936->7935 7938 79e61 ___vcrt_FlsFree 5 API calls 7937->7938 7939 79ec4 7938->7939 7940 79edd TlsAlloc 7939->7940 7941 79b7e 7939->7941 7941->7913 7942 79f5b 7941->7942 7943 79e61 ___vcrt_FlsFree 5 API calls 7942->7943 7944 79f75 7943->7944 7945 79f90 TlsSetValue 7944->7945 7946 79b97 7944->7946 7945->7946 7946->7910 7947 79ba7 7946->7947 7948 79bb1 7947->7948 7949 79bb7 7947->7949 7951 79ee5 7948->7951 7949->7913 7952 79e61 ___vcrt_FlsFree 5 API calls 7951->7952 7953 79eff 7952->7953 7954 79f17 TlsFree 7953->7954 7955 79f0b 7953->7955 7954->7955 7955->7949 7957 77c98 GetStartupInfoW 7956->7957 7957->7840 7959 76d91 56 API calls 7958->7959 7960 76852 7959->7960 7961 7686b GetModuleFileNameW 7960->7961 7962 76883 7961->7962 7984 7695a 7962->7984 8021 7660f 7962->8021 7964 7699d 7966 768c0 8051 76f37 7966->8051 7967 768ce 8060 76e65 7967->8060 7970 768cc 8036 76c80 7970->8036 7972 768eb 8040 76fb4 7972->8040 7974 768f6 8044 76d30 7974->8044 7976 76908 7977 76d91 56 API calls 7976->7977 7978 76918 7977->7978 7979 7692d SHGetFolderPathW 7978->7979 7980 76946 7979->7980 7980->7984 8073 76cf6 7980->8073 7982 76952 7983 76cf6 CharLowerBuffW 7982->7983 7983->7984 7984->7844 7986 7660f 56 API calls 7985->7986 7987 76d99 7986->7987 7987->7846 7989 76a7b __FrameHandler3::FrameUnwindToState 7988->7989 7990 76a8a GetModuleFileNameW 7989->7990 7991 76aa5 7990->7991 7992 76aaf PathRemoveFileSpecW 7990->7992 7994 767da GetLastError 7991->7994 8291 7b67a 7992->8291 8010 76aaa 7994->8010 7996 76aeb 8300 767f5 7996->8300 7999 76bd6 7999->7849 7999->7850 8001 76b1d 8003 7b67a 41 API calls 8001->8003 8002 76afa 8005 76e65 41 API calls 8002->8005 8004 76b35 8003->8004 8006 76d91 56 API calls 8004->8006 8005->8010 8007 76b43 8006->8007 8306 769a8 RegOpenKeyExW 8007->8306 8009 76b54 8009->8010 8011 76b5a PathAppendW 8009->8011 8310 773a8 8010->8310 8012 76b7f 8011->8012 8013 76b6d PathAppendW 8011->8013 8015 767da GetLastError 8012->8015 8013->8012 8014 76b88 8013->8014 8016 767f5 6 API calls 8014->8016 8015->8010 8017 76b93 8016->8017 8017->8010 8018 76e65 41 API calls 8017->8018 8018->8010 8020 767e4 8019->8020 8020->7850 8022 76626 8021->8022 8023 7663d 8021->8023 8026 774c5 6 API calls 8022->8026 8035 76638 8022->8035 8078 774c5 EnterCriticalSection 8023->8078 8025 76648 8025->8022 8027 76652 GetProcessHeap 8025->8027 8028 7668d 8026->8028 8083 777d7 8027->8083 8031 777d7 44 API calls 8028->8031 8028->8035 8032 766da 8031->8032 8034 7747b __Init_thread_footer 5 API calls 8032->8034 8034->8035 8035->7964 8035->7966 8035->7967 8159 76db8 8036->8159 8038 76c8e PathRemoveFileSpecW 8039 76c9d 8038->8039 8039->7972 8041 76fbf 8040->8041 8043 76fcd 8041->8043 8161 7705e 8041->8161 8043->7974 8045 76d5c 8044->8045 8046 76d48 8044->8046 8045->7976 8047 76d7d 8046->8047 8048 76d57 8046->8048 8049 76e65 41 API calls 8047->8049 8050 76fb4 14 API calls 8048->8050 8049->8045 8050->8045 8167 77341 EnterCriticalSection 8051->8167 8053 76f4c 8054 76fa9 8053->8054 8055 76f62 FindResourceExW 8053->8055 8056 77341 5 API calls 8053->8056 8058 76f9a 8053->8058 8172 764f9 LoadResource 8053->8172 8054->7970 8055->8053 8056->8053 8058->8054 8176 770d2 FindResourceW 8058->8176 8062 76e7d 8060->8062 8063 76e73 __InternalCxxFrameHandler 8060->8063 8061 76f11 8062->8061 8064 76ef7 8062->8064 8065 76ead 8062->8065 8063->7970 8066 7705e 14 API calls 8064->8066 8065->8063 8067 76ebe 8065->8067 8069 76ed4 8065->8069 8066->8063 8068 7baa8 __freea 14 API calls 8067->8068 8070 76ec3 8068->8070 8069->8063 8071 7baa8 __freea 14 API calls 8069->8071 8072 7b9ea ___std_exception_copy 41 API calls 8070->8072 8071->8070 8072->8063 8074 76d05 8073->8074 8075 76d25 8074->8075 8076 76d10 CharLowerBuffW 8074->8076 8077 76d20 8076->8077 8077->7982 8082 774d9 8078->8082 8079 774de LeaveCriticalSection 8079->8025 8082->8079 8091 7754d 8082->8091 8096 777aa 8083->8096 8086 7747b EnterCriticalSection LeaveCriticalSection 8087 77517 8086->8087 8088 77533 SetEvent ResetEvent 8087->8088 8089 77522 RtlWakeAllConditionVariable 8087->8089 8088->8022 8089->8022 8092 77574 LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 8091->8092 8093 7755b SleepConditionVariableCS 8091->8093 8094 77598 8092->8094 8093->8094 8094->8082 8097 777c0 8096->8097 8098 777b9 8096->8098 8105 7c839 8097->8105 8102 7c7bc 8098->8102 8101 76678 8101->8086 8103 7c839 44 API calls 8102->8103 8104 7c7ce 8103->8104 8104->8101 8108 7c585 8105->8108 8109 7c591 __FrameHandler3::FrameUnwindToState 8108->8109 8116 7d5f2 EnterCriticalSection 8109->8116 8111 7c59f 8117 7c5e0 8111->8117 8113 7c5ac 8127 7c5d4 8113->8127 8116->8111 8118 7c5fb 8117->8118 8119 7c66e _unexpected 8117->8119 8118->8119 8120 7c64e 8118->8120 8130 7bad6 8118->8130 8119->8113 8120->8119 8121 7bad6 44 API calls 8120->8121 8123 7c664 8121->8123 8125 7d4db __freea 14 API calls 8123->8125 8124 7c644 8126 7d4db __freea 14 API calls 8124->8126 8125->8119 8126->8120 8158 7d63a LeaveCriticalSection 8127->8158 8129 7c5bd 8129->8101 8131 7bae3 8130->8131 8132 7bafe 8130->8132 8131->8132 8133 7baef 8131->8133 8134 7bb0d 8132->8134 8139 7d515 8132->8139 8135 7baa8 __freea 14 API calls 8133->8135 8146 7d548 8134->8146 8138 7baf4 __FrameHandler3::FrameUnwindToState 8135->8138 8138->8124 8140 7d535 HeapSize 8139->8140 8141 7d520 8139->8141 8140->8134 8142 7baa8 __freea 14 API calls 8141->8142 8143 7d525 8142->8143 8144 7b9ea ___std_exception_copy 41 API calls 8143->8144 8145 7d530 8144->8145 8145->8134 8147 7d555 8146->8147 8148 7d560 8146->8148 8149 7fa79 15 API calls 8147->8149 8150 7d568 8148->8150 8157 7d571 _unexpected 8148->8157 8155 7d55d 8149->8155 8153 7d4db __freea 14 API calls 8150->8153 8151 7d576 8154 7baa8 __freea 14 API calls 8151->8154 8152 7d59b HeapReAlloc 8152->8155 8152->8157 8153->8155 8154->8155 8155->8138 8156 7ed0c _unexpected EnterCriticalSection LeaveCriticalSection 8156->8157 8157->8151 8157->8152 8157->8156 8158->8129 8160 76de9 8159->8160 8162 77070 8161->8162 8164 77093 __InternalCxxFrameHandler 8161->8164 8163 7baa8 __freea 14 API calls 8162->8163 8165 77079 __FrameHandler3::FrameUnwindToState 8162->8165 8163->8165 8164->8043 8165->8164 8166 7baa8 14 API calls __freea 8165->8166 8166->8165 8168 77363 LeaveCriticalSection 8167->8168 8169 7735a 8167->8169 8168->8053 8169->8168 8182 7731c 8169->8182 8173 7650f LockResource 8172->8173 8175 7652f 8172->8175 8174 7651c SizeofResource 8173->8174 8173->8175 8174->8175 8175->8053 8177 770f3 8176->8177 8178 77122 8176->8178 8179 764f9 3 API calls 8177->8179 8178->8054 8180 77100 8179->8180 8180->8178 8194 7b5ca 8180->8194 8183 77326 8182->8183 8185 7732b 8183->8185 8192 76460 RaiseException 8183->8192 8185->8168 8188 77363 LeaveCriticalSection 8188->8168 8189 7735a 8189->8188 8191 7731c RaiseException 8189->8191 8191->8188 8193 76474 EnterCriticalSection 8192->8193 8193->8188 8193->8189 8195 7b5db 8194->8195 8201 7b5d7 __InternalCxxFrameHandler 8194->8201 8196 7b5e2 8195->8196 8200 7b5f5 _wmemset 8195->8200 8197 7baa8 __freea 14 API calls 8196->8197 8198 7b5e7 8197->8198 8208 7b9ea 8198->8208 8200->8201 8202 7b626 8200->8202 8203 7b62f 8200->8203 8201->8178 8204 7baa8 __freea 14 API calls 8202->8204 8203->8201 8205 7baa8 __freea 14 API calls 8203->8205 8206 7b62b 8204->8206 8205->8206 8207 7b9ea ___std_exception_copy 41 API calls 8206->8207 8207->8201 8211 7b936 8208->8211 8212 7b948 ___std_exception_copy 8211->8212 8217 7b96d 8212->8217 8214 7b960 8228 7b726 8214->8228 8218 7b97d 8217->8218 8219 7b984 8217->8219 8234 7b78b GetLastError 8218->8234 8224 7b992 8219->8224 8238 7b762 8219->8238 8222 7b9b9 8222->8224 8241 7b9fa IsProcessorFeaturePresent 8222->8241 8224->8214 8225 7b9e9 8226 7b936 ___std_exception_copy 41 API calls 8225->8226 8227 7b9f6 8226->8227 8227->8214 8229 7b732 8228->8229 8230 7b749 8229->8230 8273 7b7d1 8229->8273 8232 7b75c 8230->8232 8233 7b7d1 ___std_exception_copy 41 API calls 8230->8233 8232->8201 8233->8232 8235 7b7a4 8234->8235 8245 7d3f2 8235->8245 8239 7b786 8238->8239 8240 7b76d GetLastError SetLastError 8238->8240 8239->8222 8240->8222 8242 7ba06 8241->8242 8267 7b7ee 8242->8267 8246 7d405 8245->8246 8247 7d40b 8245->8247 8249 7e8b3 _unexpected 6 API calls 8246->8249 8248 7e8f2 _unexpected 6 API calls 8247->8248 8266 7b7bc SetLastError 8247->8266 8250 7d425 8248->8250 8249->8247 8251 7d682 _unexpected 14 API calls 8250->8251 8250->8266 8252 7d435 8251->8252 8253 7d452 8252->8253 8254 7d43d 8252->8254 8256 7e8f2 _unexpected 6 API calls 8253->8256 8255 7e8f2 _unexpected 6 API calls 8254->8255 8258 7d449 8255->8258 8257 7d45e 8256->8257 8259 7d462 8257->8259 8260 7d471 8257->8260 8263 7d4db __freea 14 API calls 8258->8263 8261 7e8f2 _unexpected 6 API calls 8259->8261 8262 7d01e _unexpected 14 API calls 8260->8262 8261->8258 8264 7d47c 8262->8264 8263->8266 8265 7d4db __freea 14 API calls 8264->8265 8265->8266 8266->8219 8268 7b80a __FrameHandler3::FrameUnwindToState 8267->8268 8269 7b836 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 8268->8269 8272 7b907 __FrameHandler3::FrameUnwindToState 8269->8272 8270 773a8 __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 8271 7b925 GetCurrentProcess TerminateProcess 8270->8271 8271->8225 8272->8270 8274 7b7e4 8273->8274 8275 7b7db 8273->8275 8274->8230 8276 7b78b ___std_exception_copy 16 API calls 8275->8276 8277 7b7e0 8276->8277 8277->8274 8280 7cce5 8277->8280 8281 7ee63 __FrameHandler3::FrameUnwindToState EnterCriticalSection LeaveCriticalSection 8280->8281 8282 7ccea 8281->8282 8283 7eea8 __FrameHandler3::FrameUnwindToState 40 API calls 8282->8283 8287 7ccf5 8282->8287 8283->8287 8284 7cd1e 8286 7bf79 __FrameHandler3::FrameUnwindToState 23 API calls 8284->8286 8285 7ccff IsProcessorFeaturePresent 8288 7cd0b 8285->8288 8290 7cd28 8286->8290 8287->8284 8287->8285 8289 7b7ee __FrameHandler3::FrameUnwindToState 8 API calls 8288->8289 8289->8284 8292 7b696 8291->8292 8293 7b688 8291->8293 8294 7baa8 __freea 14 API calls 8292->8294 8293->8292 8298 7b6b0 8293->8298 8295 7b6a0 8294->8295 8296 7b9ea ___std_exception_copy 41 API calls 8295->8296 8297 76ad0 PathAppendW 8296->8297 8297->7991 8297->7996 8298->8297 8299 7baa8 __freea 14 API calls 8298->8299 8299->8295 8301 7680c 8300->8301 8303 76832 8300->8303 8302 76813 GetFileAttributesExW 8301->8302 8301->8303 8302->8303 8304 773a8 __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 8303->8304 8305 7683f 8304->8305 8305->8001 8305->8002 8307 769e5 8306->8307 8309 769d9 8306->8309 8308 769fd SHQueryValueExW 8307->8308 8308->8309 8309->8009 8311 773b1 IsProcessorFeaturePresent 8310->8311 8312 773b0 8310->8312 8314 77a85 8311->8314 8312->7999 8317 77a48 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 8314->8317 8316 77b68 8316->7999 8317->8316 8319 7be1f 8318->8319 8320 7be0d 8318->8320 8330 7bc89 8319->8330 8321 77cbe __FrameHandler3::FrameUnwindToState GetModuleHandleW 8320->8321 8323 7be12 8321->8323 8323->8319 8345 7beca GetModuleHandleExW 8323->8345 8324 77a32 8324->7881 8328 7be71 8331 7bc95 __FrameHandler3::FrameUnwindToState 8330->8331 8351 7d5f2 EnterCriticalSection 8331->8351 8333 7bc9f 8352 7bcf5 8333->8352 8335 7bcac 8356 7bcca 8335->8356 8338 7be77 8381 7bea8 8338->8381 8341 7be95 8343 7beca __FrameHandler3::FrameUnwindToState 3 API calls 8341->8343 8342 7be85 GetCurrentProcess TerminateProcess 8342->8341 8344 7be9d ExitProcess 8343->8344 8346 7bf2a 8345->8346 8347 7bf09 GetProcAddress 8345->8347 8348 7bf30 FreeLibrary 8346->8348 8349 7be1e 8346->8349 8347->8346 8350 7bf1d 8347->8350 8348->8349 8349->8319 8350->8346 8351->8333 8353 7bd01 __FrameHandler3::FrameUnwindToState 8352->8353 8355 7bd68 __FrameHandler3::FrameUnwindToState 8353->8355 8359 7c7d2 8353->8359 8355->8335 8380 7d63a LeaveCriticalSection 8356->8380 8358 7bcb8 8358->8324 8358->8338 8360 7c7de __EH_prolog3 8359->8360 8363 7c52a 8360->8363 8362 7c805 __FrameHandler3::FrameUnwindToState 8362->8355 8364 7c536 __FrameHandler3::FrameUnwindToState 8363->8364 8371 7d5f2 EnterCriticalSection 8364->8371 8366 7c544 8372 7c6e2 8366->8372 8371->8366 8373 7c701 8372->8373 8374 7c551 8372->8374 8373->8374 8375 7d4db __freea 14 API calls 8373->8375 8376 7c579 8374->8376 8375->8374 8379 7d63a LeaveCriticalSection 8376->8379 8378 7c562 8378->8362 8379->8378 8380->8358 8386 7d651 GetPEB 8381->8386 8384 7be81 8384->8341 8384->8342 8385 7beb2 GetPEB 8385->8384 8387 7d66b 8386->8387 8388 7bead 8386->8388 8390 7e7f5 8387->8390 8388->8384 8388->8385 8391 7e772 _unexpected 5 API calls 8390->8391 8392 7e811 8391->8392 8392->8388 8394 7d206 8393->8394 8395 7d20c 8393->8395 8396 7e8b3 _unexpected 6 API calls 8394->8396 8397 7e8f2 _unexpected 6 API calls 8395->8397 8399 7d210 SetLastError 8395->8399 8396->8395 8398 7d228 8397->8398 8398->8399 8401 7d682 _unexpected 14 API calls 8398->8401 8403 7d2a5 8399->8403 8404 7cc5b 8399->8404 8402 7d23d 8401->8402 8405 7d256 8402->8405 8406 7d245 8402->8406 8407 7cce5 __FrameHandler3::FrameUnwindToState 39 API calls 8403->8407 8404->7863 8409 7e8f2 _unexpected 6 API calls 8405->8409 8408 7e8f2 _unexpected 6 API calls 8406->8408 8410 7d2aa 8407->8410 8418 7d253 8408->8418 8411 7d262 8409->8411 8412 7d266 8411->8412 8413 7d27d 8411->8413 8415 7e8f2 _unexpected 6 API calls 8412->8415 8414 7d01e _unexpected 14 API calls 8413->8414 8417 7d288 8414->8417 8415->8418 8416 7d4db __freea 14 API calls 8416->8399 8419 7d4db __freea 14 API calls 8417->8419 8418->8416 8419->8399 8421 7c996 ___scrt_uninitialize_crt 8420->8421 8422 7c984 8420->8422 8421->7875 8423 7c992 8422->8423 8425 7f346 8422->8425 8423->7875 8428 7f1d3 8425->8428 8431 7f127 8428->8431 8432 7f133 __FrameHandler3::FrameUnwindToState 8431->8432 8439 7d5f2 EnterCriticalSection 8432->8439 8434 7f13d ___scrt_uninitialize_crt 8435 7f1a9 8434->8435 8440 7f09b 8434->8440 8448 7f1c7 8435->8448 8439->8434 8441 7f0a7 __FrameHandler3::FrameUnwindToState 8440->8441 8451 7f463 EnterCriticalSection 8441->8451 8443 7f0fd 8465 7f11b 8443->8465 8444 7f0b1 ___scrt_uninitialize_crt 8444->8443 8452 7f2e1 8444->8452 8567 7d63a LeaveCriticalSection 8448->8567 8450 7f1b5 8450->8423 8451->8444 8453 7f2f6 ___std_exception_copy 8452->8453 8454 7f2fd 8453->8454 8455 7f308 8453->8455 8456 7f1d3 ___scrt_uninitialize_crt 70 API calls 8454->8456 8468 7f278 8455->8468 8458 7f303 8456->8458 8460 7b726 ___std_exception_copy 41 API calls 8458->8460 8462 7f340 8460->8462 8462->8443 8463 7f329 8481 80ed4 8463->8481 8566 7f477 LeaveCriticalSection 8465->8566 8467 7f109 8467->8434 8469 7f291 8468->8469 8473 7f2b8 8468->8473 8470 8060d ___scrt_uninitialize_crt 41 API calls 8469->8470 8469->8473 8471 7f2ad 8470->8471 8492 816ff 8471->8492 8473->8458 8474 8060d 8473->8474 8475 80619 8474->8475 8476 8062e 8474->8476 8477 7baa8 __freea 14 API calls 8475->8477 8476->8463 8478 8061e 8477->8478 8479 7b9ea ___std_exception_copy 41 API calls 8478->8479 8480 80629 8479->8480 8480->8463 8482 80ee5 8481->8482 8485 80ef2 8481->8485 8483 7baa8 __freea 14 API calls 8482->8483 8487 80eea 8483->8487 8484 80f3b 8486 7baa8 __freea 14 API calls 8484->8486 8485->8484 8488 80f19 8485->8488 8489 80f40 8486->8489 8487->8458 8533 80e32 8488->8533 8491 7b9ea ___std_exception_copy 41 API calls 8489->8491 8491->8487 8495 8170b __FrameHandler3::FrameUnwindToState 8492->8495 8493 81713 8493->8473 8494 817cf 8496 7b96d ___std_exception_copy 41 API calls 8494->8496 8495->8493 8495->8494 8497 81760 8495->8497 8496->8493 8503 7f6b2 EnterCriticalSection 8497->8503 8499 81766 8500 81783 8499->8500 8504 81807 8499->8504 8530 817c7 8500->8530 8503->8499 8505 8182c 8504->8505 8528 8184f ___scrt_uninitialize_crt 8504->8528 8506 81830 8505->8506 8508 8188e 8505->8508 8507 7b96d ___std_exception_copy 41 API calls 8506->8507 8507->8528 8509 818a5 8508->8509 8510 81ede ___scrt_uninitialize_crt 43 API calls 8508->8510 8511 8138b ___scrt_uninitialize_crt 42 API calls 8509->8511 8510->8509 8512 818af 8511->8512 8513 818f5 8512->8513 8514 818b5 8512->8514 8515 81958 WriteFile 8513->8515 8516 81909 8513->8516 8517 818df 8514->8517 8522 818bc 8514->8522 8518 8197a GetLastError 8515->8518 8515->8528 8520 81911 8516->8520 8521 81946 8516->8521 8519 80f51 ___scrt_uninitialize_crt 47 API calls 8517->8519 8518->8528 8519->8528 8523 81934 8520->8523 8524 81916 8520->8524 8526 81409 ___scrt_uninitialize_crt 7 API calls 8521->8526 8525 81323 ___scrt_uninitialize_crt 6 API calls 8522->8525 8522->8528 8527 815cd ___scrt_uninitialize_crt 8 API calls 8523->8527 8524->8528 8529 814e4 ___scrt_uninitialize_crt 7 API calls 8524->8529 8525->8528 8526->8528 8527->8528 8528->8500 8529->8528 8531 7f6d5 ___scrt_uninitialize_crt LeaveCriticalSection 8530->8531 8532 817cd 8531->8532 8532->8493 8534 80e3e __FrameHandler3::FrameUnwindToState 8533->8534 8546 7f6b2 EnterCriticalSection 8534->8546 8536 80e4d 8537 80e92 8536->8537 8547 7f789 8536->8547 8539 7baa8 __freea 14 API calls 8537->8539 8541 80e99 8539->8541 8540 80e79 FlushFileBuffers 8540->8541 8542 80e85 GetLastError 8540->8542 8563 80ec8 8541->8563 8560 7ba95 8542->8560 8546->8536 8548 7f796 8547->8548 8550 7f7ab 8547->8550 8549 7ba95 ___scrt_uninitialize_crt 14 API calls 8548->8549 8552 7f79b 8549->8552 8551 7ba95 ___scrt_uninitialize_crt 14 API calls 8550->8551 8553 7f7d0 8550->8553 8554 7f7db 8551->8554 8555 7baa8 __freea 14 API calls 8552->8555 8553->8540 8556 7baa8 __freea 14 API calls 8554->8556 8557 7f7a3 8555->8557 8558 7f7e3 8556->8558 8557->8540 8559 7b9ea ___std_exception_copy 41 API calls 8558->8559 8559->8557 8561 7d341 __FrameHandler3::FrameUnwindToState 14 API calls 8560->8561 8562 7ba9a 8561->8562 8562->8537 8564 7f6d5 ___scrt_uninitialize_crt LeaveCriticalSection 8563->8564 8565 80eb1 8564->8565 8565->8487 8566->8467 8567->8450 7555 7d341 GetLastError 7556 7d357 7555->7556 7559 7d35d 7555->7559 7590 7e8b3 7556->7590 7575 7d361 SetLastError 7559->7575 7578 7e8f2 7559->7578 7564 7d3a7 7566 7e8f2 _unexpected 6 API calls 7564->7566 7565 7d396 7567 7e8f2 _unexpected 6 API calls 7565->7567 7569 7d3b3 7566->7569 7568 7d3a4 7567->7568 7595 7d4db 7568->7595 7570 7d3b7 7569->7570 7571 7d3ce 7569->7571 7572 7e8f2 _unexpected 6 API calls 7570->7572 7601 7d01e 7571->7601 7572->7568 7577 7d4db __freea 12 API calls 7577->7575 7606 7e772 7578->7606 7581 7d379 7581->7575 7583 7d682 7581->7583 7582 7e92c TlsSetValue 7588 7d68f _unexpected 7583->7588 7584 7d6cf 7624 7baa8 7584->7624 7585 7d6ba RtlAllocateHeap 7586 7d38e 7585->7586 7585->7588 7586->7564 7586->7565 7588->7584 7588->7585 7621 7ed0c 7588->7621 7591 7e772 _unexpected 5 API calls 7590->7591 7592 7e8cf 7591->7592 7593 7e8ea TlsGetValue 7592->7593 7594 7e8d8 7592->7594 7594->7559 7596 7d4e6 HeapFree 7595->7596 7597 7d510 7595->7597 7596->7597 7598 7d4fb GetLastError 7596->7598 7597->7575 7599 7d508 __freea 7598->7599 7600 7baa8 __freea 12 API calls 7599->7600 7600->7597 7661 7ceb2 7601->7661 7607 7e7a0 7606->7607 7610 7e79c 7606->7610 7607->7610 7613 7e6a7 7607->7613 7610->7581 7610->7582 7611 7e7ba GetProcAddress 7611->7610 7612 7e7ca _unexpected 7611->7612 7612->7610 7619 7e6b8 ___vcrt_FlsFree 7613->7619 7614 7e74e 7614->7610 7614->7611 7615 7e6d6 LoadLibraryExW 7616 7e755 7615->7616 7617 7e6f1 GetLastError 7615->7617 7616->7614 7618 7e767 FreeLibrary 7616->7618 7617->7619 7618->7614 7619->7614 7619->7615 7620 7e724 LoadLibraryExW 7619->7620 7620->7616 7620->7619 7627 7ed39 7621->7627 7638 7d341 GetLastError 7624->7638 7626 7baad 7626->7586 7628 7ed45 __FrameHandler3::FrameUnwindToState 7627->7628 7633 7d5f2 EnterCriticalSection 7628->7633 7630 7ed50 7634 7ed8c 7630->7634 7633->7630 7637 7d63a LeaveCriticalSection 7634->7637 7636 7ed17 7636->7588 7637->7636 7639 7d357 7638->7639 7642 7d35d 7638->7642 7640 7e8b3 _unexpected 6 API calls 7639->7640 7640->7642 7641 7e8f2 _unexpected 6 API calls 7643 7d379 7641->7643 7642->7641 7658 7d361 SetLastError 7642->7658 7645 7d682 _unexpected 12 API calls 7643->7645 7643->7658 7646 7d38e 7645->7646 7647 7d3a7 7646->7647 7648 7d396 7646->7648 7649 7e8f2 _unexpected 6 API calls 7647->7649 7650 7e8f2 _unexpected 6 API calls 7648->7650 7652 7d3b3 7649->7652 7651 7d3a4 7650->7651 7656 7d4db __freea 12 API calls 7651->7656 7653 7d3b7 7652->7653 7654 7d3ce 7652->7654 7655 7e8f2 _unexpected 6 API calls 7653->7655 7657 7d01e _unexpected 12 API calls 7654->7657 7655->7651 7656->7658 7659 7d3d9 7657->7659 7658->7626 7660 7d4db __freea 12 API calls 7659->7660 7660->7658 7662 7cebe __FrameHandler3::FrameUnwindToState 7661->7662 7675 7d5f2 EnterCriticalSection 7662->7675 7664 7cec8 7676 7cef8 7664->7676 7667 7cfc4 7668 7cfd0 __FrameHandler3::FrameUnwindToState 7667->7668 7680 7d5f2 EnterCriticalSection 7668->7680 7670 7cfda 7681 7d1a5 7670->7681 7672 7cff2 7685 7d012 7672->7685 7675->7664 7679 7d63a LeaveCriticalSection 7676->7679 7678 7cee6 7678->7667 7679->7678 7680->7670 7682 7d1b4 _unexpected 7681->7682 7683 7d1db _unexpected 7681->7683 7682->7683 7688 7fcbb 7682->7688 7683->7672 7802 7d63a LeaveCriticalSection 7685->7802 7687 7d000 7687->7577 7689 7fd3b 7688->7689 7692 7fcd1 7688->7692 7691 7d4db __freea 14 API calls 7689->7691 7714 7fd89 7689->7714 7693 7fd5d 7691->7693 7692->7689 7696 7d4db __freea 14 API calls 7692->7696 7698 7fd04 7692->7698 7694 7d4db __freea 14 API calls 7693->7694 7697 7fd70 7694->7697 7695 7fd97 7700 7fdf7 7695->7700 7713 7d4db 14 API calls __freea 7695->7713 7701 7fcf9 7696->7701 7702 7d4db __freea 14 API calls 7697->7702 7703 7d4db __freea 14 API calls 7698->7703 7715 7fd26 7698->7715 7699 7d4db __freea 14 API calls 7704 7fd30 7699->7704 7705 7d4db __freea 14 API calls 7700->7705 7716 7f809 7701->7716 7707 7fd7e 7702->7707 7708 7fd1b 7703->7708 7709 7d4db __freea 14 API calls 7704->7709 7710 7fdfd 7705->7710 7711 7d4db __freea 14 API calls 7707->7711 7744 7f907 7708->7744 7709->7689 7710->7683 7711->7714 7713->7695 7756 7fe2c 7714->7756 7715->7699 7717 7f81a 7716->7717 7743 7f903 7716->7743 7718 7f82b 7717->7718 7719 7d4db __freea 14 API calls 7717->7719 7720 7d4db __freea 14 API calls 7718->7720 7722 7f83d 7718->7722 7719->7718 7720->7722 7721 7f84f 7724 7d4db __freea 14 API calls 7721->7724 7726 7f861 7721->7726 7722->7721 7723 7d4db __freea 14 API calls 7722->7723 7723->7721 7724->7726 7725 7f873 7728 7f885 7725->7728 7729 7d4db __freea 14 API calls 7725->7729 7726->7725 7727 7d4db __freea 14 API calls 7726->7727 7727->7725 7730 7f897 7728->7730 7732 7d4db __freea 14 API calls 7728->7732 7729->7728 7731 7f8a9 7730->7731 7733 7d4db __freea 14 API calls 7730->7733 7734 7f8bb 7731->7734 7735 7d4db __freea 14 API calls 7731->7735 7732->7730 7733->7731 7736 7f8cd 7734->7736 7737 7d4db __freea 14 API calls 7734->7737 7735->7734 7738 7f8df 7736->7738 7740 7d4db __freea 14 API calls 7736->7740 7737->7736 7739 7f8f1 7738->7739 7741 7d4db __freea 14 API calls 7738->7741 7742 7d4db __freea 14 API calls 7739->7742 7739->7743 7740->7738 7741->7739 7742->7743 7743->7698 7745 7f914 7744->7745 7755 7f96c 7744->7755 7746 7f924 7745->7746 7747 7d4db __freea 14 API calls 7745->7747 7748 7d4db __freea 14 API calls 7746->7748 7751 7f936 7746->7751 7747->7746 7748->7751 7749 7f948 7750 7f95a 7749->7750 7753 7d4db __freea 14 API calls 7749->7753 7754 7d4db __freea 14 API calls 7750->7754 7750->7755 7751->7749 7752 7d4db __freea 14 API calls 7751->7752 7752->7749 7753->7750 7754->7755 7755->7715 7757 7fe39 7756->7757 7761 7fe58 7756->7761 7757->7761 7762 7f995 7757->7762 7760 7d4db __freea 14 API calls 7760->7761 7761->7695 7763 7fa73 7762->7763 7764 7f9a6 7762->7764 7763->7760 7798 7f970 7764->7798 7767 7f970 _unexpected 14 API calls 7768 7f9b9 7767->7768 7769 7f970 _unexpected 14 API calls 7768->7769 7770 7f9c4 7769->7770 7771 7f970 _unexpected 14 API calls 7770->7771 7772 7f9cf 7771->7772 7773 7f970 _unexpected 14 API calls 7772->7773 7774 7f9dd 7773->7774 7775 7d4db __freea 14 API calls 7774->7775 7776 7f9e8 7775->7776 7777 7d4db __freea 14 API calls 7776->7777 7778 7f9f3 7777->7778 7779 7d4db __freea 14 API calls 7778->7779 7780 7f9fe 7779->7780 7781 7f970 _unexpected 14 API calls 7780->7781 7782 7fa0c 7781->7782 7783 7f970 _unexpected 14 API calls 7782->7783 7784 7fa1a 7783->7784 7785 7f970 _unexpected 14 API calls 7784->7785 7786 7fa2b 7785->7786 7787 7f970 _unexpected 14 API calls 7786->7787 7788 7fa39 7787->7788 7789 7f970 _unexpected 14 API calls 7788->7789 7790 7fa47 7789->7790 7791 7d4db __freea 14 API calls 7790->7791 7792 7fa52 7791->7792 7793 7d4db __freea 14 API calls 7792->7793 7794 7fa5d 7793->7794 7795 7d4db __freea 14 API calls 7794->7795 7796 7fa68 7795->7796 7797 7d4db __freea 14 API calls 7796->7797 7797->7763 7799 7f982 7798->7799 7800 7f991 7799->7800 7801 7d4db __freea 14 API calls 7799->7801 7800->7767 7801->7799 7802->7687 9821 7ebd8 9822 7ebe4 __FrameHandler3::FrameUnwindToState 9821->9822 9833 7d5f2 EnterCriticalSection 9822->9833 9824 7ebeb 9825 7f614 42 API calls 9824->9825 9826 7ebfa 9825->9826 9832 7ec09 9826->9832 9834 7ea72 GetStartupInfoW 9826->9834 9845 7ec2f 9832->9845 9833->9824 9835 7eb23 9834->9835 9836 7ea8f 9834->9836 9840 7eb28 9835->9840 9836->9835 9837 7f614 42 API calls 9836->9837 9838 7eab7 9837->9838 9838->9835 9839 7eae7 GetFileType 9838->9839 9839->9838 9844 7eb2f 9840->9844 9841 7eb72 GetStdHandle 9841->9844 9842 7ebd4 9842->9832 9843 7eb85 GetFileType 9843->9844 9844->9841 9844->9842 9844->9843 9848 7d63a LeaveCriticalSection 9845->9848 9847 7ec1a 9848->9847 9130 7ea69 GetStartupInfoW 9131 7ea8f 9130->9131 9133 7eb23 9130->9133 9131->9133 9136 7f614 9131->9136 9134 7eab7 9134->9133 9135 7eae7 GetFileType 9134->9135 9135->9134 9137 7f620 __FrameHandler3::FrameUnwindToState 9136->9137 9138 7f64a 9137->9138 9139 7f629 9137->9139 9149 7d5f2 EnterCriticalSection 9138->9149 9141 7baa8 __freea 14 API calls 9139->9141 9142 7f62e 9141->9142 9143 7b9ea ___std_exception_copy 41 API calls 9142->9143 9145 7f638 9143->9145 9144 7f682 9157 7f6a9 9144->9157 9145->9134 9146 7f656 9146->9144 9150 7f564 9146->9150 9149->9146 9151 7d682 _unexpected 14 API calls 9150->9151 9154 7f576 9151->9154 9152 7f583 9153 7d4db __freea 14 API calls 9152->9153 9156 7f5d8 9153->9156 9154->9152 9155 7e934 6 API calls 9154->9155 9155->9154 9156->9146 9160 7d63a LeaveCriticalSection 9157->9160 9159 7f6b0 9159->9145 9160->9159

                                                                                                                                                                Executed Functions

                                                                                                                                                                Function 00076BD8 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 61libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories), ref: 00076BE6
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000), ref: 00076BED
                                                                                                                                                                • LoadLibraryExW.KERNELBASE(?,00000000,00000000), ref: 00076C2C
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,DllEntry), ref: 00076C47
                                                                                                                                                                • GetCommandLineW.KERNEL32(?), ref: 00076C56
                                                                                                                                                                • FreeLibrary.KERNELBASE(00000000), ref: 00076C69
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000006.00000002.2179645124.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                • Associated: 00000006.00000002.2179613044.0000000000070000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179681542.0000000000085000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179709810.0000000000087000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_6_2_70000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressLibraryProc$CommandFreeHandleLineLoadModule
                                                                                                                                                                • String ID: DllEntry$SetDefaultDllDirectories$kernel32.dll
                                                                                                                                                                • API String ID: 1042781669-3472957018
                                                                                                                                                                • Opcode ID: 212897fe2da5caa412a125b2d080d6c10d659e6c9b480dd7d175b9fdf640786c
                                                                                                                                                                • Instruction ID: 3f0ef961413902308e321aa10f4c248683bfb77285b425f4dba7d7c943f50366
                                                                                                                                                                • Opcode Fuzzy Hash: 212897fe2da5caa412a125b2d080d6c10d659e6c9b480dd7d175b9fdf640786c
                                                                                                                                                                • Instruction Fuzzy Hash: AD112931D00A1AFBD712A7A0DC45FBE3768EB01750F208010F98BB7251DE6DDD009B69
                                                                                                                                                                Function 00076A46 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 123COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 00076A9B
                                                                                                                                                                • PathRemoveFileSpecW.SHLWAPI(?,?,?,00000104), ref: 00076AB6
                                                                                                                                                                • PathAppendW.SHLWAPI(?,goopdate.dll,?,?,00000104), ref: 00076AE5
                                                                                                                                                                  • Part of subcall function 000767DA: GetLastError.KERNEL32(00076AAA,?,?,00000104), ref: 000767DA
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000006.00000002.2179645124.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                • Associated: 00000006.00000002.2179613044.0000000000070000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179681542.0000000000085000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179709810.0000000000087000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_6_2_70000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FilePath$AppendErrorLastModuleNameRemoveSpec
                                                                                                                                                                • String ID: goopdate.dll
                                                                                                                                                                • API String ID: 3739599460-235033069
                                                                                                                                                                • Opcode ID: aaf52f57502431508c273653a2d68bb5543aa619c6e7d30e925d5e901cdf7735
                                                                                                                                                                • Instruction ID: 698b156c2eb9d1fcfa9ba18e31b5d93ea3400080e05bf1637c456eaf3b3dbb24
                                                                                                                                                                • Opcode Fuzzy Hash: aaf52f57502431508c273653a2d68bb5543aa619c6e7d30e925d5e901cdf7735
                                                                                                                                                                • Instruction Fuzzy Hash: CA4164B1D0061C9ADB20EB64DC45FDE737C9B45344F10C5E5A50EE3143EB399E858B68
                                                                                                                                                                Function 0007E6A7 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 67 7e6a7-7e6b3 68 7e745-7e748 67->68 69 7e74e 68->69 70 7e6b8-7e6c9 68->70 71 7e750-7e754 69->71 72 7e6d6-7e6ef LoadLibraryExW 70->72 73 7e6cb-7e6ce 70->73 74 7e755-7e765 72->74 75 7e6f1-7e6fa GetLastError 72->75 76 7e6d4 73->76 77 7e76e-7e770 73->77 74->77 80 7e767-7e768 FreeLibrary 74->80 78 7e733-7e740 75->78 79 7e6fc-7e70e call 7ce78 75->79 81 7e742 76->81 77->71 78->81 79->78 84 7e710-7e722 call 7ce78 79->84 80->77 81->68 84->78 87 7e724-7e731 LoadLibraryExW 84->87 87->74 87->78
                                                                                                                                                                APIs
                                                                                                                                                                • FreeLibrary.KERNEL32(00000000,?,0007E7B4,0007C86A,0000000C,?,00000000,00000000,?,0007E90E,00000021,FlsSetValue,00072924,0007292C,?), ref: 0007E768
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000006.00000002.2179645124.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                • Associated: 00000006.00000002.2179613044.0000000000070000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179681542.0000000000085000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179709810.0000000000087000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_6_2_70000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FreeLibrary
                                                                                                                                                                • String ID: api-ms-$ext-ms-
                                                                                                                                                                • API String ID: 3664257935-537541572
                                                                                                                                                                • Opcode ID: 6be59d256e4efe7e2086082a274473f3d1f7ee5f1f7ba28af153439b86d4e792
                                                                                                                                                                • Instruction ID: 1704a5d40e64adc4c2b85a7435d73b40a3312927cfb89a1d3ed1b789f423267c
                                                                                                                                                                • Opcode Fuzzy Hash: 6be59d256e4efe7e2086082a274473f3d1f7ee5f1f7ba28af153439b86d4e792
                                                                                                                                                                • Instruction Fuzzy Hash: 37212B32E06290A7DB759B24DC44E5A33A8EF16760F254154E95DAB2D1EB3CEE00CBD8
                                                                                                                                                                Function 000769A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61registryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 88 769a8-769d7 RegOpenKeyExW 89 769e5-76a1d call 76db8 SHQueryValueExW call 76cd0 88->89 90 769d9 88->90 96 76a22-76a24 89->96 91 76a42-76a45 90->91 92 769db-769e3 90->92 92->91 97 76a26 96->97 98 76a35-76a3d 96->98 99 76a31-76a33 97->99 100 76a28-76a2b 97->100 98->91 99->91 100->99
                                                                                                                                                                APIs
                                                                                                                                                                • RegOpenKeyExW.KERNELBASE(?,Software\AVG\Browser\Update\Clients\{1C89EF2F-A88E-4DE0-97FE-CB40C8E4FEEA},00000000,00020019,?,?,?), ref: 000769CF
                                                                                                                                                                • SHQueryValueExW.SHLWAPI(?,00075D08,00000000,?,00000000,?,00000032,?,?), ref: 00076A12
                                                                                                                                                                Strings
                                                                                                                                                                • Software\AVG\Browser\Update\Clients\{1C89EF2F-A88E-4DE0-97FE-CB40C8E4FEEA}, xrefs: 000769C1
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000006.00000002.2179645124.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                • Associated: 00000006.00000002.2179613044.0000000000070000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179681542.0000000000085000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179709810.0000000000087000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_6_2_70000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: OpenQueryValue
                                                                                                                                                                • String ID: Software\AVG\Browser\Update\Clients\{1C89EF2F-A88E-4DE0-97FE-CB40C8E4FEEA}
                                                                                                                                                                • API String ID: 4153817207-1120627182
                                                                                                                                                                • Opcode ID: 370c6c7c1ecae24fd30c231ede6871d8547891654a7cdb522ab6c5c0dbccac21
                                                                                                                                                                • Instruction ID: adeb28bb037a4bd4314282b7fdd76cd620adbb8420c0df01ac43c618e1a9d23b
                                                                                                                                                                • Opcode Fuzzy Hash: 370c6c7c1ecae24fd30c231ede6871d8547891654a7cdb522ab6c5c0dbccac21
                                                                                                                                                                • Instruction Fuzzy Hash: 01118A76D40519BA9B20DB6D8C059FFBEFCEB40711F108255B85AE6181D6798E00CBA4
                                                                                                                                                                Function 0007BE77 Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 101 7be77-7be83 call 7bea8 104 7be95-7bea1 call 7beca ExitProcess 101->104 105 7be85-7be8f GetCurrentProcess TerminateProcess 101->105 105->104
                                                                                                                                                                APIs
                                                                                                                                                                • GetCurrentProcess.KERNEL32(?,?,0007BE71,?,0007B7ED,?,?,5E12F5C3,0007B7ED,?), ref: 0007BE88
                                                                                                                                                                • TerminateProcess.KERNEL32(00000000,?,0007BE71,?,0007B7ED,?,?,5E12F5C3,0007B7ED,?), ref: 0007BE8F
                                                                                                                                                                • ExitProcess.KERNEL32 ref: 0007BEA1
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000006.00000002.2179645124.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                • Associated: 00000006.00000002.2179613044.0000000000070000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179681542.0000000000085000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179709810.0000000000087000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_6_2_70000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Process$CurrentExitTerminate
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1703294689-0
                                                                                                                                                                • Opcode ID: 4dd3c6f1727db86e231b17a6436a4f438c7c16b0b3ffa3b7bc45c76f3b996eb0
                                                                                                                                                                • Instruction ID: 68cb2dcbe154f110ca54267a9fe630e20d0d87aed8e70c81328294ab712d622e
                                                                                                                                                                • Opcode Fuzzy Hash: 4dd3c6f1727db86e231b17a6436a4f438c7c16b0b3ffa3b7bc45c76f3b996eb0
                                                                                                                                                                • Instruction Fuzzy Hash: 19D09232404208EBDF512F60DD0DAEA3F6ABF40351B248014FA5D5A276DF39DA529FA5
                                                                                                                                                                Function 00076841 Relevance: 3.1, APIs: 2, Instructions: 122COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 108 76841-76885 call 76d91 call 76db8 GetModuleFileNameW call 76cd0 115 7698e-7699c call 76f1c 108->115 116 7688b-76891 108->116 116->115 118 76897-768a3 call 7660f 116->118 122 7699d-769a7 call 76475 118->122 123 768a9-768b6 118->123 127 768d7 123->127 128 768b8-768be 123->128 129 768d9-768de call 76e65 127->129 130 768c0-768cc call 76f37 128->130 131 768ce-768d5 call 7b2f2 128->131 137 768e3-76941 call 76c80 call 76fb4 call 76d30 call 76f1c call 76d91 call 76db8 SHGetFolderPathW call 76cd0 129->137 130->137 131->129 151 76946-76948 137->151 152 7697e-76989 call 76f1c * 2 151->152 153 7694a-7695f call 76cf6 * 2 151->153 152->115 161 76961-76967 153->161 162 76979-7697b 153->162 161->162 163 76969-76970 call 771fe 161->163 162->152 163->162 166 76972-76977 163->166 166->162
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,00000104), ref: 00076873
                                                                                                                                                                • SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,00000000,00000104,?,?,00000000), ref: 00076936
                                                                                                                                                                  • Part of subcall function 00076F37: FindResourceExW.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,?,00000000,?,?,000768CC,-00000010), ref: 00076F68
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000006.00000002.2179645124.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                • Associated: 00000006.00000002.2179613044.0000000000070000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179681542.0000000000085000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179709810.0000000000087000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_6_2_70000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileFindFolderModuleNamePathResource
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2248019921-0
                                                                                                                                                                • Opcode ID: 1bc6e20c75251e9ee38d13b70ccff6241031d5a33c15e3bc5f5789d10fc54842
                                                                                                                                                                • Instruction ID: c48501dc7aede8a36bcd641fa051778c3db72e1ac30c02bdc1493be0e3316501
                                                                                                                                                                • Opcode Fuzzy Hash: 1bc6e20c75251e9ee38d13b70ccff6241031d5a33c15e3bc5f5789d10fc54842
                                                                                                                                                                • Instruction Fuzzy Hash: 1F418371D00919ABDB14EFA5D8959FEB7B8EF00300F108169E95BA7292EF3E5E04CB54
                                                                                                                                                                Function 0007D341 Relevance: 2.6, APIs: 2, Instructions: 67COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 167 7d341-7d355 GetLastError 168 7d357-7d35f call 7e8b3 167->168 169 7d371-7d37b call 7e8f2 167->169 174 7d361-7d36a 168->174 175 7d36c 168->175 176 7d381-7d389 call 7d682 169->176 177 7d37d-7d37f 169->177 178 7d3e6-7d3f1 SetLastError 174->178 175->169 180 7d38e-7d394 176->180 177->178 181 7d3a7-7d3b5 call 7e8f2 180->181 182 7d396-7d3a5 call 7e8f2 180->182 188 7d3b7-7d3c5 call 7e8f2 181->188 189 7d3ce-7d3e3 call 7d01e call 7d4db 181->189 187 7d3c6-7d3cc call 7d4db 182->187 196 7d3e5 187->196 188->187 189->196 196->178
                                                                                                                                                                APIs
                                                                                                                                                                • GetLastError.KERNEL32(00000000,00000000,0007BAAD,0007D57B,?,0007BB1F,00000000,0007C86A,00000004,?,00000000,?,0007C664,?,00000004,00000004), ref: 0007D345
                                                                                                                                                                • SetLastError.KERNEL32(00000000), ref: 0007D3E7
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000006.00000002.2179645124.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                • Associated: 00000006.00000002.2179613044.0000000000070000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179681542.0000000000085000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179709810.0000000000087000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_6_2_70000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLast
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1452528299-0
                                                                                                                                                                • Opcode ID: a04a1cd8c21d6c1e9ac5157669fb455e32ab59b8318c3327cc28b61c91813574
                                                                                                                                                                • Instruction ID: a7ae4afdcf967bac1d380e995db99173e9bbafa3ac4fce764738371d34fb2983
                                                                                                                                                                • Opcode Fuzzy Hash: a04a1cd8c21d6c1e9ac5157669fb455e32ab59b8318c3327cc28b61c91813574
                                                                                                                                                                • Instruction Fuzzy Hash: B211E571E497246BE66027B0DCD5EAA26E8BF443A5B248132F14C910E2DF5C8D0157AA
                                                                                                                                                                Function 0007E772 Relevance: 1.6, APIs: 1, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 199 7e772-7e79a 200 7e7a0-7e7a2 199->200 201 7e79c-7e79e 199->201 203 7e7a4-7e7a6 200->203 204 7e7a8-7e7af call 7e6a7 200->204 202 7e7f1-7e7f4 201->202 203->202 206 7e7b4-7e7b8 204->206 207 7e7d7-7e7ee 206->207 208 7e7ba-7e7c8 GetProcAddress 206->208 209 7e7f0 207->209 208->207 210 7e7ca-7e7d5 call 7bcd6 208->210 209->202 210->209
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000006.00000002.2179645124.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                • Associated: 00000006.00000002.2179613044.0000000000070000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179681542.0000000000085000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179709810.0000000000087000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_6_2_70000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: eec4b5f9aa4e9364826507f48f4022e4b6fbaccefd185e700e73ed8eed828b5c
                                                                                                                                                                • Instruction ID: 940a14e72494ff2d9ab792e1a9b2822a24aedc31f314761076a1ae5269d6a1cc
                                                                                                                                                                • Opcode Fuzzy Hash: eec4b5f9aa4e9364826507f48f4022e4b6fbaccefd185e700e73ed8eed828b5c
                                                                                                                                                                • Instruction Fuzzy Hash: 9601F537B055619BEB2ACE6DEC8095E37D6BBC8360B24C170F908DB185DA38D801C795
                                                                                                                                                                Function 0007D682 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 213 7d682-7d68d 214 7d68f-7d699 213->214 215 7d69b-7d6a1 213->215 214->215 216 7d6cf-7d6da call 7baa8 214->216 217 7d6a3-7d6a4 215->217 218 7d6ba-7d6cb RtlAllocateHeap 215->218 222 7d6dc-7d6de 216->222 217->218 219 7d6a6-7d6ad call 7cc0e 218->219 220 7d6cd 218->220 219->216 226 7d6af-7d6b8 call 7ed0c 219->226 220->222 226->216 226->218
                                                                                                                                                                APIs
                                                                                                                                                                • RtlAllocateHeap.NTDLL(00000008,?,?,?,0007D38E,00000001,00000364,?,00000006,000000FF,?,0007BB1F,00000000,0007C86A,00000004), ref: 0007D6C3
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000006.00000002.2179645124.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                • Associated: 00000006.00000002.2179613044.0000000000070000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179681542.0000000000085000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179709810.0000000000087000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_6_2_70000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocateHeap
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1279760036-0
                                                                                                                                                                • Opcode ID: 0d19e45f632561d6efef1d378f8315fc3504b21faf59a324d5e709a85e33010d
                                                                                                                                                                • Instruction ID: 1932810aa676c6d926e073a46748c176882a7c8cf1de129277e6ee986b52f2c0
                                                                                                                                                                • Opcode Fuzzy Hash: 0d19e45f632561d6efef1d378f8315fc3504b21faf59a324d5e709a85e33010d
                                                                                                                                                                • Instruction Fuzzy Hash: 95F0B432E1152466AB626A619C15B5A37A9AF81760B25C053E84CE61A5CA2CEC0086AC

                                                                                                                                                                Non-executed Functions

                                                                                                                                                                Function 00077B6A Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00077B76
                                                                                                                                                                • IsDebuggerPresent.KERNEL32 ref: 00077C42
                                                                                                                                                                • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00077C62
                                                                                                                                                                • UnhandledExceptionFilter.KERNEL32(?), ref: 00077C6C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000006.00000002.2179645124.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                • Associated: 00000006.00000002.2179613044.0000000000070000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179681542.0000000000085000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179709810.0000000000087000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_6_2_70000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 254469556-0
                                                                                                                                                                • Opcode ID: b82a6ddfbaa8ea3017f631431ee06fd8de4456379b611d7d2ce636ad4ba95bff
                                                                                                                                                                • Instruction ID: e73b4636d0b6887afd79110fd0100c0fec78b9664107e06797c92046cf21eeb5
                                                                                                                                                                • Opcode Fuzzy Hash: b82a6ddfbaa8ea3017f631431ee06fd8de4456379b611d7d2ce636ad4ba95bff
                                                                                                                                                                • Instruction Fuzzy Hash: CA311875D05218DBEB21DFA4D989BCDBBF8BF08340F1041AAE40DAB250EB749B848F45
                                                                                                                                                                Function 000773DD Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • InitializeCriticalSectionAndSpinCount.KERNEL32(0008592C,00000FA0,?,?,000773BB), ref: 000773E9
                                                                                                                                                                • GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,000773BB), ref: 000773F4
                                                                                                                                                                • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,000773BB), ref: 00077405
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00077417
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00077425
                                                                                                                                                                • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,000773BB), ref: 00077448
                                                                                                                                                                • DeleteCriticalSection.KERNEL32(0008592C,00000007,?,?,000773BB), ref: 00077464
                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?,?,000773BB), ref: 00077474
                                                                                                                                                                Strings
                                                                                                                                                                • WakeAllConditionVariable, xrefs: 0007741D
                                                                                                                                                                • SleepConditionVariableCS, xrefs: 00077411
                                                                                                                                                                • api-ms-win-core-synch-l1-2-0.dll, xrefs: 000773EF
                                                                                                                                                                • kernel32.dll, xrefs: 00077400
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000006.00000002.2179645124.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                • Associated: 00000006.00000002.2179613044.0000000000070000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179681542.0000000000085000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179709810.0000000000087000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_6_2_70000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
                                                                                                                                                                • String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                                                                                                                                • API String ID: 2565136772-3242537097
                                                                                                                                                                • Opcode ID: 49f97f4b789dbe56146b36cea0a2454c42f649ed635ef6f6022686f7b23e5c2a
                                                                                                                                                                • Instruction ID: 63613a7d51931e029c3021f2761974d041c32424e431e936899b9408ca514f56
                                                                                                                                                                • Opcode Fuzzy Hash: 49f97f4b789dbe56146b36cea0a2454c42f649ed635ef6f6022686f7b23e5c2a
                                                                                                                                                                • Instruction Fuzzy Hash: 06018D31E49711EBF7211B75AC0DB563E98BB44762B114410FBDDE9294D76CC8408F69
                                                                                                                                                                Function 0007A620 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • IsInExceptionSpec.LIBVCRUNTIME ref: 0007A71D
                                                                                                                                                                • type_info::operator==.LIBVCRUNTIME ref: 0007A73F
                                                                                                                                                                • ___TypeMatch.LIBVCRUNTIME ref: 0007A84E
                                                                                                                                                                • IsInExceptionSpec.LIBVCRUNTIME ref: 0007A920
                                                                                                                                                                • _UnwindNestedFrames.LIBCMT ref: 0007A9A4
                                                                                                                                                                • CallUnexpected.LIBVCRUNTIME ref: 0007A9BF
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000006.00000002.2179645124.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                • Associated: 00000006.00000002.2179613044.0000000000070000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179681542.0000000000085000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179709810.0000000000087000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_6_2_70000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
                                                                                                                                                                • String ID: csm$csm$csm
                                                                                                                                                                • API String ID: 2123188842-393685449
                                                                                                                                                                • Opcode ID: e0268ef57cbc18da8f3c2d840e0b48bf55a0fb694a013a01aed2899e6d0ad5af
                                                                                                                                                                • Instruction ID: 837c45a5638c33ba1c8cbe0c1919a4ec344fecef05fe53c2b7974e6dce4de12b
                                                                                                                                                                • Opcode Fuzzy Hash: e0268ef57cbc18da8f3c2d840e0b48bf55a0fb694a013a01aed2899e6d0ad5af
                                                                                                                                                                • Instruction Fuzzy Hash: 27B19D71E00209EFCF59DFA4C8819AEB7B5FF85310B15C059E8096B242D738DA61CF9A
                                                                                                                                                                Function 00079760 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • _ValidateLocalCookies.LIBCMT ref: 00079797
                                                                                                                                                                • ___except_validate_context_record.LIBVCRUNTIME ref: 0007979F
                                                                                                                                                                • _ValidateLocalCookies.LIBCMT ref: 00079828
                                                                                                                                                                • __IsNonwritableInCurrentImage.LIBCMT ref: 00079853
                                                                                                                                                                • _ValidateLocalCookies.LIBCMT ref: 000798A8
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000006.00000002.2179645124.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                • Associated: 00000006.00000002.2179613044.0000000000070000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179681542.0000000000085000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179709810.0000000000087000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_6_2_70000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                                                                • String ID: csm
                                                                                                                                                                • API String ID: 1170836740-1018135373
                                                                                                                                                                • Opcode ID: b67aad34e47844cb3a787fcc0eee5aca5bfac4b2d296d59ad597a6934d859195
                                                                                                                                                                • Instruction ID: 2bcd8a86e5d90be495f2d7fddb809831d7e697d26c289a27ebd11f1da43142e3
                                                                                                                                                                • Opcode Fuzzy Hash: b67aad34e47844cb3a787fcc0eee5aca5bfac4b2d296d59ad597a6934d859195
                                                                                                                                                                • Instruction Fuzzy Hash: 22418F34E10219ABCF50DF68C884ADEBBF5BF46324F14C155E818AB392DB399A05CB95
                                                                                                                                                                Function 00079AE2 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetLastError.KERNEL32(?,?,00079AD9,00079A6A,00077D51), ref: 00079AF0
                                                                                                                                                                • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00079AFE
                                                                                                                                                                • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00079B17
                                                                                                                                                                • SetLastError.KERNEL32(00000000,00079AD9,00079A6A,00077D51), ref: 00079B69
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000006.00000002.2179645124.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                • Associated: 00000006.00000002.2179613044.0000000000070000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179681542.0000000000085000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179709810.0000000000087000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_6_2_70000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLastValue___vcrt_
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3852720340-0
                                                                                                                                                                • Opcode ID: 5af5b1828721feab4908485520b855604d5563f4f2b1f0ce3d1dbeb8e62a0560
                                                                                                                                                                • Instruction ID: ff7f8c6a2098efeba3aea35742d18441de425bd4d3df9d936d41fea5143552ac
                                                                                                                                                                • Opcode Fuzzy Hash: 5af5b1828721feab4908485520b855604d5563f4f2b1f0ce3d1dbeb8e62a0560
                                                                                                                                                                • Instruction Fuzzy Hash: 30014C32D1E711ADF66427B47C85AEB2694FB01B723308239F41C801E2EF1D4C01978C
                                                                                                                                                                Function 00079DC7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • FreeLibrary.KERNEL32(00000000,?,?,?,00079E88,?,?,00085CEC,00000000,?,00079FB3,00000004,InitializeCriticalSectionEx,00071C14,InitializeCriticalSectionEx,00000000), ref: 00079E57
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000006.00000002.2179645124.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                • Associated: 00000006.00000002.2179613044.0000000000070000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179681542.0000000000085000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179709810.0000000000087000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_6_2_70000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FreeLibrary
                                                                                                                                                                • String ID: api-ms-
                                                                                                                                                                • API String ID: 3664257935-2084034818
                                                                                                                                                                • Opcode ID: 19078e2324839eed3261a07ccfba39d9e8e3270ffaae08de44fded7a8cdd402d
                                                                                                                                                                • Instruction ID: d1ceb61fdba0086b27c320becf2cb966424e3e5e70ed1ea5ddc3d916f5f8f2b7
                                                                                                                                                                • Opcode Fuzzy Hash: 19078e2324839eed3261a07ccfba39d9e8e3270ffaae08de44fded7a8cdd402d
                                                                                                                                                                • Instruction Fuzzy Hash: E911E332E44320ABEB328B289C05B5A73D4BF02B60F218110F918EB290D778EC008BD8
                                                                                                                                                                Function 0007BECA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,5E12F5C3,?,?,00000000,00084492,000000FF,?,0007BE9D,?,?,0007BE71,?), ref: 0007BEFF
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0007BF11
                                                                                                                                                                • FreeLibrary.KERNEL32(00000000,?,00000000,00084492,000000FF,?,0007BE9D,?,?,0007BE71,?), ref: 0007BF33
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000006.00000002.2179645124.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                • Associated: 00000006.00000002.2179613044.0000000000070000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179681542.0000000000085000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179709810.0000000000087000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_6_2_70000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                • API String ID: 4061214504-1276376045
                                                                                                                                                                • Opcode ID: 2856bd19cf94acc585b7ba0531ed018d2e10c43a40db689fddd2d976c47ae702
                                                                                                                                                                • Instruction ID: fde49e5e13c346a222a2e9d6df04575ae3f17d0d75e3abd8cac210c396c1c95a
                                                                                                                                                                • Opcode Fuzzy Hash: 2856bd19cf94acc585b7ba0531ed018d2e10c43a40db689fddd2d976c47ae702
                                                                                                                                                                • Instruction Fuzzy Hash: 56014F31918616EBEB119F54DC09BAEBBB8FB04B11F108525E916A66D0DB7C9900CF94
                                                                                                                                                                Function 00080B70 Relevance: 7.7, APIs: 5, Instructions: 202COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __alloca_probe_16.LIBCMT ref: 00080BF7
                                                                                                                                                                • __alloca_probe_16.LIBCMT ref: 00080CB8
                                                                                                                                                                • __freea.LIBCMT ref: 00080D1F
                                                                                                                                                                  • Part of subcall function 0007FA79: HeapAlloc.KERNEL32(00000000,00000000,0007C86A,?,0007D55D,?,00000000,?,0007BB1F,00000000,0007C86A,00000004,?,00000000,?,0007C664), ref: 0007FAAB
                                                                                                                                                                • __freea.LIBCMT ref: 00080D34
                                                                                                                                                                • __freea.LIBCMT ref: 00080D44
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000006.00000002.2179645124.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                • Associated: 00000006.00000002.2179613044.0000000000070000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179681542.0000000000085000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179709810.0000000000087000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_6_2_70000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: __freea$__alloca_probe_16$AllocHeap
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1096550386-0
                                                                                                                                                                • Opcode ID: 8daa5e152d4da9276f2681b18badd4504a42a900ec051ff5523b7325cb9aa172
                                                                                                                                                                • Instruction ID: 24b329c104a13a6d02b2fc5787d6c21b146d765228e8bfd5892cbcc83cf711e2
                                                                                                                                                                • Opcode Fuzzy Hash: 8daa5e152d4da9276f2681b18badd4504a42a900ec051ff5523b7325cb9aa172
                                                                                                                                                                • Instruction Fuzzy Hash: B551C172A0020AAFEBA1AFA4CD41EFF76E9FF04350B154129FD48D7251E674DC1487A4
                                                                                                                                                                Function 00080F51 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetConsoleOutputCP.KERNEL32(5E12F5C3,?,00000000,?), ref: 00080FB4
                                                                                                                                                                  • Part of subcall function 0007E537: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00080D15,?,00000000,-00000008), ref: 0007E5E3
                                                                                                                                                                • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0008120F
                                                                                                                                                                • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00081257
                                                                                                                                                                • GetLastError.KERNEL32 ref: 000812FA
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000006.00000002.2179645124.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                • Associated: 00000006.00000002.2179613044.0000000000070000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179681542.0000000000085000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179709810.0000000000087000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_6_2_70000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2112829910-0
                                                                                                                                                                • Opcode ID: b9ca6663990008a65c77eeb1939e0b77efba33aef8a4864f56210e65612379c2
                                                                                                                                                                • Instruction ID: 36c56f33cd0116ec28c97e3164550b4de575a414daa116c939fb1b0064f46693
                                                                                                                                                                • Opcode Fuzzy Hash: b9ca6663990008a65c77eeb1939e0b77efba33aef8a4864f56210e65612379c2
                                                                                                                                                                • Instruction Fuzzy Hash: 47D168B5D046489FDF15DFA8D8809EDBBF9FF08310F18816AE895EB352D630A942CB50
                                                                                                                                                                Function 0007A3C9 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000006.00000002.2179645124.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                • Associated: 00000006.00000002.2179613044.0000000000070000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179681542.0000000000085000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179709810.0000000000087000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_6_2_70000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AdjustPointer
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1740715915-0
                                                                                                                                                                • Opcode ID: edc2a5475ca19e2c13b6c29dab2169c79125b12cbc5baa4fd52800037748c08b
                                                                                                                                                                • Instruction ID: ebef1fa2057087f5ce30f961793fb399412f6308c5a853de41ba785124a6478f
                                                                                                                                                                • Opcode Fuzzy Hash: edc2a5475ca19e2c13b6c29dab2169c79125b12cbc5baa4fd52800037748c08b
                                                                                                                                                                • Instruction Fuzzy Hash: B451CF72F01602AFDB258F14D845BAE77A4FF82310F14802DE90D56291E77AEC41CB9A
                                                                                                                                                                Function 00082766 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,00081F1A,?,00000001,?,?,?,0008134E,?,?,00000000), ref: 0008277D
                                                                                                                                                                • GetLastError.KERNEL32(?,00081F1A,?,00000001,?,?,?,0008134E,?,?,00000000,?,?,?,000818D5,?), ref: 00082789
                                                                                                                                                                  • Part of subcall function 0008274F: CloseHandle.KERNEL32(FFFFFFFE,00082799,?,00081F1A,?,00000001,?,?,?,0008134E,?,?,00000000,?,?), ref: 0008275F
                                                                                                                                                                • ___initconout.LIBCMT ref: 00082799
                                                                                                                                                                  • Part of subcall function 00082711: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00082740,00081F07,?,?,0008134E,?,?,00000000,?), ref: 00082724
                                                                                                                                                                • WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,00081F1A,?,00000001,?,?,?,0008134E,?,?,00000000,?), ref: 000827AE
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000006.00000002.2179645124.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                • Associated: 00000006.00000002.2179613044.0000000000070000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179681542.0000000000085000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179709810.0000000000087000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_6_2_70000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2744216297-0
                                                                                                                                                                • Opcode ID: efb39b863245c46b80070dc2a153e2ab73c3fb96f6a471d14700228ac33afd06
                                                                                                                                                                • Instruction ID: e3743075f02f06b02d211156f77ea51e4dffc7d68cf12038f46e43692849f036
                                                                                                                                                                • Opcode Fuzzy Hash: efb39b863245c46b80070dc2a153e2ab73c3fb96f6a471d14700228ac33afd06
                                                                                                                                                                • Instruction Fuzzy Hash: 94F0C036505124FBDF627F96DC499993FA6FF083B1F244051FE9995131CA36C820DB91
                                                                                                                                                                Function 0007754D Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SleepConditionVariableCS.KERNELBASE(?,000774EA,00000064), ref: 00077570
                                                                                                                                                                • LeaveCriticalSection.KERNEL32(0008592C,?,?,000774EA,00000064,?,00076648,000864A0,?,?,00076D99,?,00076852), ref: 0007757A
                                                                                                                                                                • WaitForSingleObjectEx.KERNEL32(?,00000000,?,000774EA,00000064,?,00076648,000864A0,?,?,00076D99,?,00076852), ref: 0007758B
                                                                                                                                                                • EnterCriticalSection.KERNEL32(0008592C,?,000774EA,00000064,?,00076648,000864A0,?,?,00076D99,?,00076852), ref: 00077592
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000006.00000002.2179645124.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                • Associated: 00000006.00000002.2179613044.0000000000070000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179681542.0000000000085000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179709810.0000000000087000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_6_2_70000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3269011525-0
                                                                                                                                                                • Opcode ID: 7adf1e54c0792654ef4d5c0676577af50688df6e111b70c3013e808828ae432c
                                                                                                                                                                • Instruction ID: 125fd3988fb406efd917fd7a4f4fe38a2dee66de1d0d668e98536057fbce8393
                                                                                                                                                                • Opcode Fuzzy Hash: 7adf1e54c0792654ef4d5c0676577af50688df6e111b70c3013e808828ae432c
                                                                                                                                                                • Instruction Fuzzy Hash: B6E09232905A24FBDB112F60EC08A9E7F29FB09772F204020F6DD6A120C66898008FD5
                                                                                                                                                                Function 0007A9CA Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0007A9EF
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000006.00000002.2179645124.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                • Associated: 00000006.00000002.2179613044.0000000000070000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179681542.0000000000085000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179709810.0000000000087000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_6_2_70000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: EncodePointer
                                                                                                                                                                • String ID: MOC$RCC
                                                                                                                                                                • API String ID: 2118026453-2084237596
                                                                                                                                                                • Opcode ID: f8c5c40bc7e8518b9559525f2798dc026b771c745b0ef13444a842bb3f94f367
                                                                                                                                                                • Instruction ID: 32a732d21a2af921d0dabc44184028a80738e71e36aff00d3e4534549f81cdf0
                                                                                                                                                                • Opcode Fuzzy Hash: f8c5c40bc7e8518b9559525f2798dc026b771c745b0ef13444a842bb3f94f367
                                                                                                                                                                • Instruction Fuzzy Hash: AB412971E00109AFCF15DF98CD81AEEBBB5FF89304F148059F909A6251D3399950DB56
                                                                                                                                                                Function 00077290 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 000764D1: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,8007000E,?,-C000001E,00000001), ref: 000764D6
                                                                                                                                                                  • Part of subcall function 000764D1: GetLastError.KERNEL32(?,00000000,?,8007000E,?,-C000001E,00000001), ref: 000764E0
                                                                                                                                                                • IsDebuggerPresent.KERNEL32(?,?,?,00076446,?), ref: 000772C3
                                                                                                                                                                • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00076446,?), ref: 000772D2
                                                                                                                                                                Strings
                                                                                                                                                                • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 000772CD
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000006.00000002.2179645124.0000000000071000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                • Associated: 00000006.00000002.2179613044.0000000000070000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179681542.0000000000085000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                • Associated: 00000006.00000002.2179709810.0000000000087000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_6_2_70000_AVGBrowserUpdate.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
                                                                                                                                                                • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                                                                                                • API String ID: 450123788-631824599
                                                                                                                                                                • Opcode ID: dde2f634575241f1b3828ef7028f2c3469e1ff91e368aad2fdf0001e58f04c67
                                                                                                                                                                • Instruction ID: ec66fc33708ba09344a7c4aa6c01c30e934390af577997c8507497ebad7c22c4
                                                                                                                                                                • Opcode Fuzzy Hash: dde2f634575241f1b3828ef7028f2c3469e1ff91e368aad2fdf0001e58f04c67
                                                                                                                                                                • Instruction Fuzzy Hash: A7E06570E047508BD3709F64D80434276E4BB00744F00C92CE49EC6786DBFDD444CB95

                                                                                                                                                                Executed Functions

                                                                                                                                                                Function 00007FF677B22374 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 239COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 619 7ff677b22374-7ff677b2246f call 7ff677b24064 SHGetFolderPathW call 7ff677b24164 call 7ff677b240dc 626 7ff677b224e1-7ff677b22505 619->626 627 7ff677b22471-7ff677b22475 619->627 628 7ff677b22527-7ff677b2252a 626->628 629 7ff677b22507-7ff677b22511 626->629 627->626 630 7ff677b22477-7ff677b224dd call 7ff677b24330 * 6 627->630 632 7ff677b2258a-7ff677b225af call 7ff677b23c30 call 7ff677b3288c 628->632 633 7ff677b2252c-7ff677b22536 628->633 629->628 631 7ff677b22513-7ff677b22525 629->631 630->626 635 7ff677b22550-7ff677b22559 631->635 650 7ff677b225b1-7ff677b225c7 632->650 651 7ff677b225e3-7ff677b2260a call 7ff677b31690 632->651 633->632 636 7ff677b22538-7ff677b2254d 633->636 635->632 640 7ff677b2255b-7ff677b22562 635->640 636->635 644 7ff677b22580-7ff677b22585 call 7ff677b245e4 640->644 645 7ff677b22564-7ff677b2257e call 7ff677b33ad0 640->645 644->632 645->632 654 7ff677b225c9-7ff677b225dc 650->654 655 7ff677b225de call 7ff677b311ac 650->655 654->655 658 7ff677b2260b-7ff677b22641 call 7ff677b392d8 654->658 655->651 668 7ff677b22653-7ff677b2266d 658->668 669 7ff677b22643-7ff677b22650 call 7ff677b121b4 658->669 672 7ff677b22673-7ff677b2267f 668->672 673 7ff677b22702-7ff677b22715 call 7ff677b3155c 668->673 669->668 676 7ff677b22681 672->676 677 7ff677b22684-7ff677b226b1 GetPrivateProfileStringW 672->677 673->672 681 7ff677b2271b-7ff677b22727 call 7ff677b313ec call 7ff677b22374 673->681 676->677 679 7ff677b226b7-7ff677b226c2 call 7ff677b396fc 677->679 680 7ff677b226b3-7ff677b226b5 677->680 682 7ff677b226c4-7ff677b226ca 679->682 684 7ff677b226f7-7ff677b22701 call 7ff677b11320 679->684 680->682 694 7ff677b2272c-7ff677b22746 call 7ff677b314fc 681->694 682->684 685 7ff677b226cc-7ff677b226f6 call 7ff677b11e0c 682->685 684->673 694->672
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FolderPathPrivateProfileString_invalid_parameter_noinfo_noreturn
                                                                                                                                                                • String ID: .ini$AVG\Browser\Update$Global$Update
                                                                                                                                                                • API String ID: 4071722814-4240150726
                                                                                                                                                                • Opcode ID: 5c376438cef7d842a0958321bc9ddcb03dcd69ca5c016e13d80acb2f4f277307
                                                                                                                                                                • Instruction ID: 1fc128648353050cd3f3e1965b0cff87967108aa4ecbf38b2fed481639fcabe5
                                                                                                                                                                • Opcode Fuzzy Hash: 5c376438cef7d842a0958321bc9ddcb03dcd69ca5c016e13d80acb2f4f277307
                                                                                                                                                                • Instruction Fuzzy Hash: DEB15C33A29B4685EB10DF25E8501A923A1FB86F88F518136EE4DC7B69DF3CE545C740
                                                                                                                                                                Function 00007FF677B17F90 Relevance: 4.5, APIs: 3, Instructions: 33libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LoadLibraryW.KERNELBASE ref: 00007FF677B17FA5
                                                                                                                                                                • GetProcAddress.KERNEL32 ref: 00007FF677B17FC2
                                                                                                                                                                • FreeLibrary.KERNELBASE ref: 00007FF677B17FE2
                                                                                                                                                                  • Part of subcall function 00007FF677B13FC8: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF677B13A30,base\utils.cc,?,00000028,00007FF677B12654), ref: 00007FF677B13FCE
                                                                                                                                                                  • Part of subcall function 00007FF677B13FC8: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,00007FF677B13A30,base\utils.cc,?,00000028,00007FF677B12654), ref: 00007FF677B14007
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Library$AddressErrorExceptionFreeLastLoadProcRaise
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 386220097-0
                                                                                                                                                                • Opcode ID: 487af87a3f68c4bf8c545f115074ce3d680f2bfca939f0213fd712a6d33fa22d
                                                                                                                                                                • Instruction ID: 2f41b82b55c2372cebebf1e17f63e00b0438a07c136cc35a2031f4a067f24f59
                                                                                                                                                                • Opcode Fuzzy Hash: 487af87a3f68c4bf8c545f115074ce3d680f2bfca939f0213fd712a6d33fa22d
                                                                                                                                                                • Instruction Fuzzy Hash: 81F04933A287C282EA945F12B84053AA791AF9AF90F1C4035EE5E87754EE3CE8918310
                                                                                                                                                                Function 00007FF677B2AC7C Relevance: 136.8, APIs: 26, Strings: 52, Instructions: 335COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _cwprintf_s_l$Concurrency::cancel_current_task
                                                                                                                                                                • String ID: -Embedding$/%s$/%s --system-level [/%s sid$/%s /%s filename [/%s$/%s /%s repairfile$/%s [/%s$/%s [/%s sid$/%s [/%s source [/%s$/%s domainurl args /%s src$/%s extra [/%s appargs [/%s src [/%s [/%s [/%s [/%s [/%s sid [/%s$/%s extra [/%s appargs [/%s src [/%s [/%s [/%s [/%s dir [/%s sid [/%s$/%s extraargs$/%s extraargs [/%s source$/%s filename [/%s [/%s customfilename$/%s pingstring$/%s repairfile$/broker$/ondemand$appargs$common\command_line.cc$crash$crashhandler$custom_info_filename$enterprise$eularequired$handoff$healthcheck$install$installelevated$installsource$machine$medsvc$nocrashserver$oem$offlinedir$offlineinstall$ping$prog.exe %s$recover$registermsihelper$registerproduct$regserver$regsvc$report$sessionid$silent$svc$uninstall$unregisterproduct$unregserver$unregsvc$update
                                                                                                                                                                • API String ID: 1899062803-4095194221
                                                                                                                                                                • Opcode ID: b294798afee56c11183aba4e8b90c90121a9e9e7ce036ad57d6eb31056fc57df
                                                                                                                                                                • Instruction ID: f41bb0e4fbb9a23059ea0f1d5277a435684083ac7db1e2ca8e46e88a5271d6c7
                                                                                                                                                                • Opcode Fuzzy Hash: b294798afee56c11183aba4e8b90c90121a9e9e7ce036ad57d6eb31056fc57df
                                                                                                                                                                • Instruction Fuzzy Hash: 23020C77939A9792EA04DF51D8404EA2360FF4AF88B845132EE1DD7669EF3CE245C380
                                                                                                                                                                Function 00007FF677B2AB68 Relevance: 135.2, APIs: 26, Strings: 51, Instructions: 407COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 133 7ff677b2ab68-7ff677b2ab84 call 7ff677b1156c 136 7ff677b2ab8a-7ff677b2aba7 call 7ff677b1156c 133->136 137 7ff677b2ac71-7ff677b2ace6 call 7ff677b11320 call 7ff677b316b0 * 2 133->137 136->137 146 7ff677b2abad-7ff677b2abc6 call 7ff677b1156c 136->146 150 7ff677b2ace8-7ff677b2acf6 call 7ff677b2f7f4 call 7ff677b311ac 137->150 151 7ff677b2acfb-7ff677b2ad06 call 7ff677b1156c 137->151 146->137 158 7ff677b2abcc-7ff677b2abe5 call 7ff677b1156c 146->158 150->151 160 7ff677b2ad0c-7ff677b2ad4e call 7ff677b11e78 call 7ff677b2b430 call 7ff677b1a990 151->160 161 7ff677b2b2a3-7ff677b2b2af call 7ff677b11320 151->161 158->137 170 7ff677b2abeb-7ff677b2ac04 call 7ff677b1156c 158->170 176 7ff677b2ad53-7ff677b2ad61 call 7ff677b2b430 160->176 170->137 179 7ff677b2ac06-7ff677b2ac1f call 7ff677b1156c 170->179 180 7ff677b2ad66-7ff677b2b278 call 7ff677b1a990 call 7ff677b2b430 call 7ff677b1a990 call 7ff677b2b430 call 7ff677b1a990 call 7ff677b2b430 call 7ff677b1a990 call 7ff677b2b430 call 7ff677b1a990 call 7ff677b2b430 call 7ff677b1a990 call 7ff677b2b430 call 7ff677b1a990 call 7ff677b2b430 call 7ff677b1a990 call 7ff677b2b430 * 4 call 7ff677b1a990 call 7ff677b2b430 call 7ff677b1a990 call 7ff677b2b430 call 7ff677b1a990 call 7ff677b2b430 call 7ff677b1a990 call 7ff677b2b430 call 7ff677b1a990 call 7ff677b2b430 call 7ff677b1a990 call 7ff677b2b430 call 7ff677b1a990 call 7ff677b2b430 call 7ff677b1a990 call 7ff677b2b430 call 7ff677b1a990 call 7ff677b2b430 call 7ff677b1a990 call 7ff677b2b430 call 7ff677b1a990 call 7ff677b2b430 call 7ff677b1a990 call 7ff677b2b430 call 7ff677b1a990 call 7ff677b2b430 call 7ff677b1a990 call 7ff677b2b430 call 7ff677b1a990 call 7ff677b2b430 call 7ff677b1a990 call 7ff677b2b430 call 7ff677b1a990 call 7ff677b2b430 176->180 179->137 188 7ff677b2ac21-7ff677b2ac3a call 7ff677b1156c 179->188 300 7ff677b2b27a-7ff677b2b27d 180->300 301 7ff677b2b283-7ff677b2b2a2 180->301 188->137 196 7ff677b2ac3c-7ff677b2ac55 call 7ff677b1156c 188->196 196->137 206 7ff677b2ac57-7ff677b2ac70 196->206 300->301
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _cwprintf_s_l$Init_thread_footer$HeapProcess
                                                                                                                                                                • String ID: -Embedding$/%s$/%s --system-level [/%s sid$/%s /%s filename [/%s$/%s /%s repairfile$/%s [/%s$/%s [/%s sid$/%s [/%s source [/%s$/%s domainurl args /%s src$/%s extra [/%s appargs [/%s src [/%s [/%s [/%s [/%s [/%s sid [/%s$/%s extra [/%s appargs [/%s src [/%s [/%s [/%s [/%s dir [/%s sid [/%s$/%s extraargs$/%s extraargs [/%s source$/%s filename [/%s [/%s customfilename$/%s pingstring$/%s repairfile$/broker$/ondemand$appargs$common\command_line.cc$crash$crashhandler$custom_info_filename$enterprise$eularequired$handoff$healthcheck$install$installelevated$installsource$machine$medsvc$nocrashserver$oem$offlinedir$offlineinstall$ping$recover$registermsihelper$registerproduct$regserver$regsvc$report$sessionid$silent$svc$uninstall$unregisterproduct$unregserver$unregsvc$update
                                                                                                                                                                • API String ID: 2347495304-136033835
                                                                                                                                                                • Opcode ID: 4c3d5de49ef1b6787cca765a6e686fd98cc7f6361f0ffb2031db106d828f9e27
                                                                                                                                                                • Instruction ID: af2ff6d20b8c912c53fa207fc2bae5a790936406794e02cbde4822e14dccaf3f
                                                                                                                                                                • Opcode Fuzzy Hash: 4c3d5de49ef1b6787cca765a6e686fd98cc7f6361f0ffb2031db106d828f9e27
                                                                                                                                                                • Instruction Fuzzy Hash: BC121C77A39B8692EA04DF55D8404E92360FF4AF88B845132EE4D97769EF3CE245C380
                                                                                                                                                                Function 00007FF677B22844 Relevance: 19.8, APIs: 2, Strings: 9, Instructions: 535COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 302 7ff677b22844-7ff677b22896 303 7ff677b22898-7ff677b228d0 call 7ff677b15e5c call 7ff677b11848 302->303 304 7ff677b228d5-7ff677b228f3 302->304 303->304 306 7ff677b228f9-7ff677b22909 GetCommandLineW call 7ff677b2a958 304->306 307 7ff677b2308a-7ff677b2309d call 7ff677b3155c 304->307 314 7ff677b2290b-7ff677b2292f call 7ff677b29450 306->314 315 7ff677b22931-7ff677b2293f 306->315 307->306 316 7ff677b230a3-7ff677b230c0 call 7ff677b21904 call 7ff677b313ec call 7ff677b314fc 307->316 319 7ff677b22944-7ff677b22952 314->319 315->319 316->306 322 7ff677b22964-7ff677b22967 319->322 323 7ff677b22954-7ff677b2295d call 7ff677b2908c 319->323 324 7ff677b22969-7ff677b22973 322->324 325 7ff677b22981-7ff677b22984 322->325 323->322 324->325 329 7ff677b22975-7ff677b2297c call 7ff677b21cfc 324->329 330 7ff677b22986-7ff677b2298d 325->330 331 7ff677b2299b-7ff677b229a2 325->331 329->325 330->331 334 7ff677b2298f-7ff677b22996 call 7ff677b21cfc 330->334 335 7ff677b229a8-7ff677b229af 331->335 336 7ff677b22a53-7ff677b22a83 call 7ff677b21f58 331->336 334->331 339 7ff677b229cb-7ff677b229d2 335->339 340 7ff677b229b1-7ff677b229c5 335->340 347 7ff677b22b47-7ff677b22b58 336->347 348 7ff677b22a89-7ff677b22a90 336->348 344 7ff677b22a0f-7ff677b22a16 339->344 345 7ff677b229d4-7ff677b229df 339->345 340->339 343 7ff677b229c7 340->343 343->339 344->336 349 7ff677b22a18-7ff677b22a23 344->349 350 7ff677b229e1-7ff677b229f1 call 7ff677b13548 345->350 351 7ff677b229f3-7ff677b22a0b call 7ff677b1211c 345->351 357 7ff677b22d0b-7ff677b22d16 347->357 358 7ff677b22b5e-7ff677b22b69 call 7ff677b244f0 347->358 353 7ff677b22a93-7ff677b22ac7 call 7ff677b2083c call 7ff677b1b384 348->353 355 7ff677b22a37-7ff677b22a4f call 7ff677b1211c 349->355 356 7ff677b22a25-7ff677b22a35 call 7ff677b13548 349->356 350->344 351->344 387 7ff677b22acc-7ff677b22ace 353->387 355->336 356->336 365 7ff677b22ec9-7ff677b22eec 357->365 366 7ff677b22d1c-7ff677b22d27 call 7ff677b244f0 357->366 373 7ff677b22b6e-7ff677b22b7c 358->373 368 7ff677b22f2e-7ff677b22f32 365->368 369 7ff677b22eee-7ff677b22f28 call 7ff677b15e5c call 7ff677b11848 365->369 376 7ff677b22d2c-7ff677b22d3a 366->376 379 7ff677b22f38-7ff677b22f40 368->379 380 7ff677b230c5-7ff677b230cb call 7ff677b2116c 368->380 369->368 374 7ff677b22bae-7ff677b22bb0 373->374 375 7ff677b22b7e-7ff677b22b80 373->375 388 7ff677b22bd8-7ff677b22bdc 374->388 389 7ff677b22bb2-7ff677b22bc6 374->389 381 7ff677b22b93-7ff677b22bac call 7ff677b1211c 375->381 382 7ff677b22b82-7ff677b22b91 call 7ff677b13548 375->382 384 7ff677b22d6c-7ff677b22d6e 376->384 385 7ff677b22d3c-7ff677b22d3e 376->385 390 7ff677b22fbe-7ff677b22fc3 call 7ff677b2083c 379->390 391 7ff677b22f42-7ff677b22fb3 call 7ff677b15e5c call 7ff677b18cdc call 7ff677b11848 379->391 381->388 382->388 404 7ff677b22d96-7ff677b22d9a 384->404 405 7ff677b22d70-7ff677b22d84 384->405 395 7ff677b22d51-7ff677b22d6a call 7ff677b1211c 385->395 396 7ff677b22d40-7ff677b22d4f call 7ff677b13548 385->396 399 7ff677b22ae1-7ff677b22aed 387->399 400 7ff677b22ad0-7ff677b22ad6 387->400 406 7ff677b22bfe-7ff677b22c00 388->406 407 7ff677b22bde-7ff677b22bf3 388->407 401 7ff677b22bc8-7ff677b22bcb 389->401 402 7ff677b22bd1-7ff677b22bd5 389->402 428 7ff677b22fca-7ff677b22ff0 call 7ff677b1bc70 390->428 391->390 468 7ff677b22fb5-7ff677b22fb8 391->468 395->404 396->404 418 7ff677b22af4-7ff677b22b09 399->418 400->353 417 7ff677b22ad8-7ff677b22adf 400->417 401->402 402->388 421 7ff677b22dbc-7ff677b22dbe 404->421 422 7ff677b22d9c-7ff677b22db1 404->422 419 7ff677b22d86-7ff677b22d89 405->419 420 7ff677b22d8f-7ff677b22d93 405->420 406->357 413 7ff677b22c06-7ff677b22c12 406->413 407->406 412 7ff677b22bf5-7ff677b22bf8 407->412 412->406 426 7ff677b22c31-7ff677b22c3e 413->426 427 7ff677b22c14-7ff677b22c2e call 7ff677b1211c 413->427 417->418 418->347 431 7ff677b22b0b-7ff677b22b1e 418->431 419->420 420->404 421->365 424 7ff677b22dc4-7ff677b22dd0 421->424 422->421 423 7ff677b22db3-7ff677b22db6 422->423 423->421 432 7ff677b22def-7ff677b22dfc 424->432 433 7ff677b22dd2-7ff677b22dec call 7ff677b1211c 424->433 437 7ff677b22c77-7ff677b22c7a 426->437 438 7ff677b22c40-7ff677b22c43 426->438 427->426 458 7ff677b2301b-7ff677b23021 428->458 459 7ff677b22ff2-7ff677b23016 call 7ff677b1ae4c 428->459 431->347 439 7ff677b22b20-7ff677b22b44 431->439 441 7ff677b22dfe-7ff677b22e01 432->441 442 7ff677b22e35-7ff677b22e38 432->442 433->432 448 7ff677b22c7c-7ff677b22c90 437->448 449 7ff677b22ca2-7ff677b22ca7 437->449 446 7ff677b22c59-7ff677b22c75 call 7ff677b1211c 438->446 447 7ff677b22c45-7ff677b22c57 call 7ff677b13548 438->447 439->347 453 7ff677b22e17-7ff677b22e33 call 7ff677b1211c 441->453 454 7ff677b22e03-7ff677b22e15 call 7ff677b13548 441->454 456 7ff677b22e3a-7ff677b22e4e 442->456 457 7ff677b22e60-7ff677b22e65 442->457 446->449 447->449 462 7ff677b22c9b-7ff677b22c9f 448->462 463 7ff677b22c92-7ff677b22c95 448->463 450 7ff677b22ca9-7ff677b22cbf 449->450 451 7ff677b22cca-7ff677b22ccd 449->451 450->451 464 7ff677b22cc1-7ff677b22cc4 450->464 451->357 465 7ff677b22ccf-7ff677b22cda 451->465 453->457 454->457 469 7ff677b22e59-7ff677b22e5d 456->469 470 7ff677b22e50-7ff677b22e53 456->470 471 7ff677b22e67-7ff677b22e7d 457->471 472 7ff677b22e88-7ff677b22e8b 457->472 458->428 475 7ff677b23023-7ff677b2302b 458->475 459->458 462->449 463->462 464->451 477 7ff677b22cdc-7ff677b22cec call 7ff677b13548 465->477 478 7ff677b22cee-7ff677b22d07 call 7ff677b1211c 465->478 468->390 469->457 470->469 471->472 481 7ff677b22e7f-7ff677b22e82 471->481 472->365 482 7ff677b22e8d-7ff677b22e98 472->482 475->380 483 7ff677b23031-7ff677b23045 call 7ff677b24240 475->483 477->357 478->357 481->472 486 7ff677b22e9a-7ff677b22eaa call 7ff677b13548 482->486 487 7ff677b22eac-7ff677b22ec5 call 7ff677b1211c 482->487 483->380 495 7ff677b23047-7ff677b23058 call 7ff677b24240 call 7ff677b21e88 483->495 486->365 487->365 500 7ff677b2305d-7ff677b23064 495->500 501 7ff677b23066-7ff677b2306a call 7ff677b21cfc 500->501 502 7ff677b2306f-7ff677b23089 500->502 501->502
                                                                                                                                                                APIs
                                                                                                                                                                • GetCommandLineW.KERNEL32 ref: 00007FF677B228F9
                                                                                                                                                                  • Part of subcall function 00007FF677B3155C: EnterCriticalSection.KERNEL32(?,?,?,00007FF677B115D9,?,?,?,00007FF677B15186,?,?,?,?,00007FF677B11009), ref: 00007FF677B3156C
                                                                                                                                                                • _Init_thread_footer.LIBCMT ref: 00007FF677B230BB
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CommandCriticalEnterInit_thread_footerLineSection
                                                                                                                                                                • String ID: HKCU\Software\AVG\Browser\Update\$HKLM\Software\AVG\Browser\Update\$[(global)::RegSetValue][%s][%s]$[(global)::UpdateRegistry]$[Global::Initialise]$common\global.cc$devmode$endpoint$hostprefix
                                                                                                                                                                • API String ID: 3276362614-1419815712
                                                                                                                                                                • Opcode ID: 979cec074d4a6c7d99e31079bf215cf02fd98eebcec67f7708f1489d89310409
                                                                                                                                                                • Instruction ID: abf49c771da8e23d6338da6f9d448ad459bc8583459bc6135656b0c54588baa4
                                                                                                                                                                • Opcode Fuzzy Hash: 979cec074d4a6c7d99e31079bf215cf02fd98eebcec67f7708f1489d89310409
                                                                                                                                                                • Instruction Fuzzy Hash: 7A428D73A29A8289E760DF35D8402B92BA0FB46F58F494232DE5DC76A9DF3CE554C340
                                                                                                                                                                Function 00007FF677B1B384 Relevance: 19.6, APIs: 3, Strings: 8, Instructions: 313registryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 504 7ff677b1b384-7ff677b1b3e1 call 7ff677b11d80 call 7ff677b1bd74 509 7ff677b1b3e7-7ff677b1b421 call 7ff677b1adc0 504->509 510 7ff677b1b844-7ff677b1b857 504->510 515 7ff677b1b427-7ff677b1b433 509->515 516 7ff677b1b7d0-7ff677b1b7de 509->516 511 7ff677b1b859-7ff677b1b85c 510->511 512 7ff677b1b862-7ff677b1b884 510->512 511->512 517 7ff677b1b439-7ff677b1b43c 515->517 518 7ff677b1b70e-7ff677b1b718 call 7ff677b1b998 515->518 519 7ff677b1b82a 516->519 520 7ff677b1b7e0-7ff677b1b825 call 7ff677b15e5c call 7ff677b11848 516->520 523 7ff677b1b692-7ff677b1b6b8 call 7ff677b1b888 517->523 524 7ff677b1b442-7ff677b1b444 517->524 526 7ff677b1b71d-7ff677b1b721 518->526 522 7ff677b1b82e-7ff677b1b83c 519->522 520->519 522->510 527 7ff677b1b83e RegCloseKey 522->527 536 7ff677b1b45d 523->536 545 7ff677b1b6be-7ff677b1b6cc 523->545 529 7ff677b1b44a-7ff677b1b44d 524->529 530 7ff677b1b612-7ff677b1b61c call 7ff677b1b950 524->530 535 7ff677b1b727-7ff677b1b735 526->535 526->536 527->510 532 7ff677b1b56c-7ff677b1b59c call 7ff677b1b888 529->532 533 7ff677b1b453-7ff677b1b456 529->533 539 7ff677b1b621-7ff677b1b625 530->539 557 7ff677b1b59e-7ff677b1b5ae call 7ff677b1ba68 532->557 558 7ff677b1b5b0-7ff677b1b5b2 532->558 540 7ff677b1b458 533->540 541 7ff677b1b49c-7ff677b1b4db SHQueryValueExW 533->541 535->536 542 7ff677b1b73b-7ff677b1b776 call 7ff677b15e5c 535->542 543 7ff677b1b461-7ff677b1b46a 536->543 539->536 546 7ff677b1b62b-7ff677b1b639 539->546 540->536 541->536 551 7ff677b1b4dd-7ff677b1b4eb 541->551 562 7ff677b1b679-7ff677b1b68d call 7ff677b11848 542->562 548 7ff677b1b48d-7ff677b1b48f 543->548 549 7ff677b1b46c-7ff677b1b489 RegCloseKey 543->549 545->536 552 7ff677b1b6d2-7ff677b1b709 call 7ff677b15e5c 545->552 546->536 553 7ff677b1b63f-7ff677b1b675 call 7ff677b15e5c 546->553 555 7ff677b1b77b-7ff677b1b789 548->555 556 7ff677b1b495-7ff677b1b497 548->556 549->548 551->536 559 7ff677b1b4f1-7ff677b1b558 call 7ff677b15e5c call 7ff677b18cdc call 7ff677b11848 551->559 552->562 553->562 555->522 563 7ff677b1b78f-7ff677b1b7ce call 7ff677b15e5c call 7ff677b11848 555->563 556->522 557->558 558->536 565 7ff677b1b5b8-7ff677b1b5c6 558->565 559->543 584 7ff677b1b55e-7ff677b1b567 559->584 562->543 563->519 565->536 572 7ff677b1b5cc-7ff677b1b610 call 7ff677b15e5c 565->572 572->562 584->543
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: lstrcmpi$Close$OpenQueryValue
                                                                                                                                                                • String ID: [Failed to read reg value: %s:%s]$[Read binary value: %s:%s, len = %d]$[Read int32 value: %s:%s = %d]$[Read int64 value: %s:%s = %s]$[Read multi string value: %s:%s = %d]$[Read string value: %s:%s = %s]$[reg value does not exist: %s]$base\reg_key.cc
                                                                                                                                                                • API String ID: 645971292-2793697986
                                                                                                                                                                • Opcode ID: 38c78c7aba95e95d18519b1e3a65b3107cb6c824b3bcea1e554a9d71d28b8840
                                                                                                                                                                • Instruction ID: 5be532c622297535d0abf8056c81553871e960822620fde2ab18b57eb01f872f
                                                                                                                                                                • Opcode Fuzzy Hash: 38c78c7aba95e95d18519b1e3a65b3107cb6c824b3bcea1e554a9d71d28b8840
                                                                                                                                                                • Instruction Fuzzy Hash: B4E17973B28B428AE7108FA4E4501AE77B5EB47B88F10413AEE9D97B98DF38D515C740
                                                                                                                                                                Function 00007FF677B30C8C Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 90libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressCommandHandleLineModuleProc
                                                                                                                                                                • String ID: Failed to parse command line argument: [%s]$SetDefaultDllDirectories$goopdate\com_register_shell.cc$i$kernel32.dll$unregister$user
                                                                                                                                                                • API String ID: 147197560-404760294
                                                                                                                                                                • Opcode ID: bfa612b1cf78a39054751c63f360b15bdd63ed1c1d02b4467ef8ad0f5671d2c9
                                                                                                                                                                • Instruction ID: 3708bde5ff4a9fbf568c972b537ce4226bfbb45edfea384ec5b3fd3326921031
                                                                                                                                                                • Opcode Fuzzy Hash: bfa612b1cf78a39054751c63f360b15bdd63ed1c1d02b4467ef8ad0f5671d2c9
                                                                                                                                                                • Instruction Fuzzy Hash: 57412973B24A0295EB00DF78D8841ED23A1FF46BA8B544235DE2D976E9DF38D589C340
                                                                                                                                                                Function 00007FF677B12A38 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 305COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 697 7ff677b12a38-7ff677b12a75 call 7ff677b11d80 call 7ff677b131ec 702 7ff677b12ab7-7ff677b12acf CommandLineToArgvW 697->702 703 7ff677b12a77-7ff677b12aa3 call 7ff677b118d0 call 7ff677b13548 697->703 705 7ff677b12add-7ff677b12ae3 702->705 706 7ff677b12ad1-7ff677b12ad8 call 7ff677b13fc8 702->706 721 7ff677b12aae-7ff677b12ab2 call 7ff677b19804 703->721 722 7ff677b12aa5-7ff677b12aa8 703->722 707 7ff677b12ae9-7ff677b12b3b call 7ff677b138fc * 2 705->707 708 7ff677b12e5c 705->708 715 7ff677b12e6a-7ff677b12e7f 706->715 725 7ff677b12b3d-7ff677b12b3f 707->725 726 7ff677b12b44-7ff677b12b4f call 7ff677b1156c 707->726 713 7ff677b12e61-7ff677b12e64 LocalFree 708->713 713->715 719 7ff677b12e8a-7ff677b12ea6 715->719 720 7ff677b12e81-7ff677b12e84 715->720 720->719 721->702 722->721 725->713 729 7ff677b12ea7-7ff677b12eb3 call 7ff677b11320 726->729 730 7ff677b12b55-7ff677b12b6a 726->730 734 7ff677b12ca8-7ff677b12cbd 730->734 735 7ff677b12b70 730->735 734->725 736 7ff677b12cc3-7ff677b12ccc 734->736 737 7ff677b12b75-7ff677b12b9b call 7ff677b11d80 call 7ff677b131ec call 7ff677b12eb4 735->737 736->725 745 7ff677b12b9d-7ff677b12baa call 7ff677b12fa0 737->745 746 7ff677b12bce-7ff677b12bd5 call 7ff677b12f0c 737->746 753 7ff677b12d2d 745->753 754 7ff677b12bb0-7ff677b12bc0 call 7ff677b12508 745->754 751 7ff677b12c56-7ff677b12c74 call 7ff677b125e8 746->751 752 7ff677b12bd7-7ff677b12be2 call 7ff677b12f0c 746->752 764 7ff677b12c7a-7ff677b12c8d 751->764 765 7ff677b12de5-7ff677b12dfe 751->765 766 7ff677b12be8-7ff677b12c27 call 7ff677b13154 call 7ff677b12fa0 752->766 767 7ff677b12ddb-7ff677b12de0 752->767 757 7ff677b12d31-7ff677b12d46 753->757 769 7ff677b12bc6-7ff677b12bc9 754->769 770 7ff677b12cd1-7ff677b12ce6 754->770 761 7ff677b12d48-7ff677b12d4b 757->761 762 7ff677b12d51-7ff677b12d66 757->762 761->762 762->713 768 7ff677b12d6c-7ff677b12d75 762->768 773 7ff677b12c98-7ff677b12c9e 764->773 774 7ff677b12c8f-7ff677b12c92 764->774 771 7ff677b12e4f-7ff677b12e53 765->771 772 7ff677b12e00-7ff677b12e4a call 7ff677b15e5c call 7ff677b11848 765->772 788 7ff677b12c29-7ff677b12c2c 766->788 789 7ff677b12c32-7ff677b12c34 766->789 767->753 768->713 769->764 770->753 776 7ff677b12ce8-7ff677b12d28 call 7ff677b15e5c call 7ff677b11848 770->776 771->708 772->771 773->737 779 7ff677b12ca4 773->779 774->773 776->753 779->734 788->789 789->757 790 7ff677b12c3a-7ff677b12c4b call 7ff677b12508 789->790 793 7ff677b12d7a-7ff677b12d8f 790->793 794 7ff677b12c51-7ff677b12c54 790->794 793->757 795 7ff677b12d91-7ff677b12dd6 call 7ff677b15e5c call 7ff677b11848 793->795 794->764 795->757
                                                                                                                                                                APIs
                                                                                                                                                                • CommandLineToArgvW.SHELL32 ref: 00007FF677B12AC3
                                                                                                                                                                  • Part of subcall function 00007FF677B118D0: GetModuleFileNameW.KERNEL32(?,?,00000000,00007FF677B119E3,?,?,?,?,?,?,?,?,?,?,?,00007FF677B11AF0), ref: 00007FF677B11947
                                                                                                                                                                • LocalFree.KERNEL32 ref: 00007FF677B12E64
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ArgvCommandFileFreeLineLocalModuleName
                                                                                                                                                                • String ID: [AddOptionalSwitch failed][%s][0x%x]$[AddSwitch failed][%s][0x%x]$[Adding switch argument failed][%d][%s][%s][0x%x]$base\command_line_parser.cc$common\command_line.cc
                                                                                                                                                                • API String ID: 871553864-2728709938
                                                                                                                                                                • Opcode ID: abc7c5bbd550ff35f3fda02894ebc7e13a6bf92847324030efb196d377efd2fc
                                                                                                                                                                • Instruction ID: 005c048de93520cedbcca27e871bce60fb71d01f54aad024489513579cf0d21a
                                                                                                                                                                • Opcode Fuzzy Hash: abc7c5bbd550ff35f3fda02894ebc7e13a6bf92847324030efb196d377efd2fc
                                                                                                                                                                • Instruction Fuzzy Hash: A8D15A77B24A4686EB10DF79C4402EC33A1EB42FA8F548232DE2D97AA9DF38D555C740
                                                                                                                                                                Function 00007FF677B4C2E8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressFreeLibraryProc
                                                                                                                                                                • String ID: api-ms-$ext-ms-
                                                                                                                                                                • API String ID: 3013587201-537541572
                                                                                                                                                                • Opcode ID: ccc87722e86747bbfddbb21e708ca936c29ab071ce780344881815c56a353a92
                                                                                                                                                                • Instruction ID: d3b771f1d4d4ec2014b95cad099a1edd753449282a8bd065be1d574c158f7945
                                                                                                                                                                • Opcode Fuzzy Hash: ccc87722e86747bbfddbb21e708ca936c29ab071ce780344881815c56a353a92
                                                                                                                                                                • Instruction Fuzzy Hash: DA41AF33B39B4291FA119F16A9141B66392BF46FE0F584135DD1DCB794EE3CE4459340
                                                                                                                                                                Function 00007FF677B20940 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 305COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 826 7ff677b20940-7ff677b2096f call 7ff677b1156c 829 7ff677b20d73-7ff677b20d7d call 7ff677b11320 826->829 830 7ff677b20975-7ff677b2099a call 7ff677b1156c 826->830 834 7ff677b20d7e-7ff677b20d8b call 7ff677b11320 829->834 830->829 839 7ff677b209a0-7ff677b209b9 call 7ff677b1156c 830->839 839->829 843 7ff677b209bf-7ff677b209d8 call 7ff677b1156c 839->843 843->829 847 7ff677b209de-7ff677b20a34 call 7ff677b316b0 call 7ff677b11c6c call 7ff677b1156c 843->847 847->829 855 7ff677b20a3a-7ff677b20a82 call 7ff677b11d80 call 7ff677b205f0 847->855 861 7ff677b20a8e-7ff677b20a90 855->861 862 7ff677b20a84-7ff677b20a87 855->862 863 7ff677b20aad 861->863 864 7ff677b20a92-7ff677b20aab call 7ff677b18bfc 861->864 862->861 866 7ff677b20ab0-7ff677b20ad0 call 7ff677b11d80 call 7ff677b1156c 863->866 864->866 866->834 872 7ff677b20ad6-7ff677b20aed call 7ff677b17e04 866->872 875 7ff677b20af2-7ff677b20af6 872->875 876 7ff677b20afc-7ff677b20b11 875->876 877 7ff677b20b82-7ff677b20ba0 875->877 880 7ff677b20b59-7ff677b20b6e 876->880 881 7ff677b20b13-7ff677b20b54 call 7ff677b15e5c call 7ff677b11848 876->881 878 7ff677b20baf-7ff677b20bc4 PathAppendW 877->878 879 7ff677b20ba2-7ff677b20bab call 7ff677b121b4 877->879 883 7ff677b20bc6-7ff677b20bc9 878->883 884 7ff677b20bcb-7ff677b20bdc call 7ff677b396fc 878->884 879->878 886 7ff677b20ccf-7ff677b20ce4 880->886 887 7ff677b20b74-7ff677b20b7d 880->887 881->880 891 7ff677b20be6-7ff677b20be9 883->891 898 7ff677b20d68-7ff677b20d72 call 7ff677b11320 884->898 904 7ff677b20be2 884->904 888 7ff677b20ce6-7ff677b20ce9 886->888 889 7ff677b20cef-7ff677b20cf5 886->889 887->886 888->889 895 7ff677b20cf7-7ff677b20d0f call 7ff677b18bfc 889->895 896 7ff677b20d11 889->896 891->898 899 7ff677b20bef-7ff677b20bff 891->899 903 7ff677b20d14-7ff677b20d28 895->903 896->903 898->829 905 7ff677b20c87-7ff677b20c8e 899->905 906 7ff677b20c05-7ff677b20c1a 899->906 911 7ff677b20d2a-7ff677b20d2d 903->911 912 7ff677b20d33-7ff677b20d48 903->912 904->891 909 7ff677b20c90-7ff677b20c93 905->909 910 7ff677b20c95-7ff677b20c98 call 7ff677b395d0 905->910 913 7ff677b20c1c-7ff677b20c5b call 7ff677b15e5c call 7ff677b11848 906->913 914 7ff677b20c60-7ff677b20c75 906->914 917 7ff677b20c9d-7ff677b20cc1 call 7ff677b11ff0 909->917 910->917 911->912 919 7ff677b20d4a-7ff677b20d4d 912->919 920 7ff677b20d53-7ff677b20d67 912->920 913->914 915 7ff677b20c77-7ff677b20c7a 914->915 916 7ff677b20c80-7ff677b20c85 914->916 915->916 916->886 926 7ff677b20ccc 917->926 927 7ff677b20cc3-7ff677b20cc6 917->927 919->920 926->886 927->926
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00007FF677B1156C: GetProcessHeap.KERNEL32(?,?,?,00007FF677B15186,?,?,?,?,00007FF677B11009), ref: 00007FF677B115E2
                                                                                                                                                                  • Part of subcall function 00007FF677B1156C: _Init_thread_footer.LIBCMT ref: 00007FF677B11617
                                                                                                                                                                  • Part of subcall function 00007FF677B1156C: _Init_thread_footer.LIBCMT ref: 00007FF677B11680
                                                                                                                                                                • PathAppendW.SHLWAPI(?,?,?,?,?,?,?,?,00000001,00000000,?,0000020BFD73CBA0,common\global.cc,0000020BFD7604B0,00000018,00007FF677B208AD), ref: 00007FF677B20BB2
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Init_thread_footer$AppendHeapPathProcess
                                                                                                                                                                • String ID: AVG\Browser\Update$GetDir failed to append path][%s][%s]$GetDir failed to find path][%d][0x%08x]$common\config_manager.cc$common\global.cc
                                                                                                                                                                • API String ID: 3356019835-3904930074
                                                                                                                                                                • Opcode ID: b856433990cb02acfda65694beccdb12dabd840fea8486896e51e81be6ede4d7
                                                                                                                                                                • Instruction ID: 45120c06a6e226e647731775c40e28f67f3167b23f20f38e5296293f2bdb5356
                                                                                                                                                                • Opcode Fuzzy Hash: b856433990cb02acfda65694beccdb12dabd840fea8486896e51e81be6ede4d7
                                                                                                                                                                • Instruction Fuzzy Hash: 1BD15B73B16B4686EB04DF69D8502AC23A1FB86FA4B144635DE2D87B95EF3CE854C340
                                                                                                                                                                Function 00007FF677B205F0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 201COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 928 7ff677b205f0-7ff677b2061e 929 7ff677b20639 928->929 930 7ff677b20620-7ff677b20624 928->930 933 7ff677b2063e-7ff677b2064c call 7ff677b1156c 929->933 931 7ff677b20626-7ff677b2062a 930->931 932 7ff677b20632-7ff677b20637 930->932 931->933 934 7ff677b2062c-7ff677b20630 931->934 932->933 937 7ff677b20652-7ff677b2066a call 7ff677b17e04 933->937 938 7ff677b20824-7ff677b2082e call 7ff677b11320 933->938 934->933 945 7ff677b2066f-7ff677b20677 937->945 942 7ff677b2082f-7ff677b2085c call 7ff677b11320 938->942 957 7ff677b208ef-7ff677b20902 call 7ff677b3155c 942->957 958 7ff677b20862-7ff677b20877 942->958 946 7ff677b20679-7ff677b2068e 945->946 947 7ff677b206db-7ff677b206f9 945->947 949 7ff677b207e3-7ff677b207f8 946->949 950 7ff677b20694-7ff677b206d6 call 7ff677b15e5c call 7ff677b11848 946->950 951 7ff677b20708-7ff677b2071d PathAppendW 947->951 952 7ff677b206fb-7ff677b20704 call 7ff677b121b4 947->952 954 7ff677b207fa-7ff677b207fd 949->954 955 7ff677b20804-7ff677b20823 949->955 950->949 960 7ff677b2071f-7ff677b20722 951->960 961 7ff677b20724-7ff677b20735 call 7ff677b396fc 951->961 952->951 954->955 957->958 977 7ff677b20908-7ff677b2093b InitializeCriticalSection call 7ff677b313ec call 7ff677b314fc 957->977 964 7ff677b20879-7ff677b20886 EnterCriticalSection 958->964 965 7ff677b20888 958->965 967 7ff677b2073f-7ff677b20742 960->967 961->942 980 7ff677b2073b 961->980 972 7ff677b20891-7ff677b2089b 964->972 965->972 967->942 969 7ff677b20748-7ff677b20758 967->969 974 7ff677b2075a-7ff677b2076f 969->974 975 7ff677b207bc-7ff677b207c3 969->975 978 7ff677b208b7-7ff677b208cc 972->978 979 7ff677b2089d-7ff677b208a8 call 7ff677b316b0 call 7ff677b20940 972->979 981 7ff677b20771-7ff677b207b0 call 7ff677b15e5c call 7ff677b11848 974->981 982 7ff677b207b5-7ff677b207ba 974->982 984 7ff677b207ca-7ff677b207cd call 7ff677b395d0 975->984 985 7ff677b207c5-7ff677b207c8 975->985 977->958 987 7ff677b208dd 978->987 988 7ff677b208ce-7ff677b208db LeaveCriticalSection 978->988 1001 7ff677b208ad-7ff677b208b0 979->1001 980->967 981->982 982->949 992 7ff677b207d2-7ff677b207e0 call 7ff677b11ff0 984->992 985->992 989 7ff677b208e6-7ff677b208ee 987->989 988->989 992->949 1001->978
                                                                                                                                                                APIs
                                                                                                                                                                • PathAppendW.SHLWAPI(?,?,?,?,?,?,00000000,00000000,?,00007FF677B20A6B), ref: 00007FF677B2070B
                                                                                                                                                                • EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FF677B20A6B), ref: 00007FF677B20880
                                                                                                                                                                • LeaveCriticalSection.KERNEL32(?,?,00000008,00007FF677B22FC3), ref: 00007FF677B208D5
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CriticalSection$AppendEnterLeavePath
                                                                                                                                                                • String ID: GetDir failed to append path][%s][%s]$GetDir failed to find path][%d][0x%08x]$common\config_manager.cc
                                                                                                                                                                • API String ID: 1368855910-1864189470
                                                                                                                                                                • Opcode ID: 9d82f0e473a3a5e56e0de90bef306a80e0a6eab6698e682d58b36b1a62883637
                                                                                                                                                                • Instruction ID: 28fb60297ba84053b88c40c321d779e1ef4359d57cd8843de60bd743531d04d4
                                                                                                                                                                • Opcode Fuzzy Hash: 9d82f0e473a3a5e56e0de90bef306a80e0a6eab6698e682d58b36b1a62883637
                                                                                                                                                                • Instruction Fuzzy Hash: E7816973B2AA4689EB14DF65D8945B823A1BB86F84B144036DE1D87BA5EF3CE441C780
                                                                                                                                                                Function 00007FF677B4A8DC Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                • GetLastError.KERNEL32(?,?,00000004,00007FF677B3942D,?,?,?,?,00007FF677B4CD06,?,?,00000000,00007FF677B3E26F,?,?,?), ref: 00007FF677B4A8EB
                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,00000004,00007FF677B3942D,?,?,?,?,00007FF677B4CD06,?,?,00000000,00007FF677B3E26F,?,?,?), ref: 00007FF677B4A921
                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,00000004,00007FF677B3942D,?,?,?,?,00007FF677B4CD06,?,?,00000000,00007FF677B3E26F,?,?,?), ref: 00007FF677B4A94E
                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,00000004,00007FF677B3942D,?,?,?,?,00007FF677B4CD06,?,?,00000000,00007FF677B3E26F,?,?,?), ref: 00007FF677B4A95F
                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,00000004,00007FF677B3942D,?,?,?,?,00007FF677B4CD06,?,?,00000000,00007FF677B3E26F,?,?,?), ref: 00007FF677B4A970
                                                                                                                                                                • SetLastError.KERNEL32(?,?,00000004,00007FF677B3942D,?,?,?,?,00007FF677B4CD06,?,?,00000000,00007FF677B3E26F,?,?,?), ref: 00007FF677B4A98B
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Value$ErrorLast
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2506987500-0
                                                                                                                                                                • Opcode ID: ba1dc859b5aac9cf08eef93998273baaeb59cbe4b5f31b77ef607430e0eb4cae
                                                                                                                                                                • Instruction ID: e0e7fd8b7c53dc3f4ca53dec222d6b26146c14f5107c34341f12acb7d70df6b2
                                                                                                                                                                • Opcode Fuzzy Hash: ba1dc859b5aac9cf08eef93998273baaeb59cbe4b5f31b77ef607430e0eb4cae
                                                                                                                                                                • Instruction Fuzzy Hash: EF119D33A2D24242FA54AF21AD5513962425F4AFB0F044739EC2EC7BD6EE2CB401A200
                                                                                                                                                                Function 00007FF677B17E04 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FolderPath
                                                                                                                                                                • String ID: LocalAppData$ProgramFiles$SHGetFolderPath failed][%d][%#x]$base\utils.cc
                                                                                                                                                                • API String ID: 1514166925-3047064361
                                                                                                                                                                • Opcode ID: f0d9bc7f0e679cec2104f3f9c7fca803576070b2f939deec827ebffe3375700d
                                                                                                                                                                • Instruction ID: a3cbcd98eb9f3696786c0fd1c0d7cbbea49af537a8e86a0cfcbd4934fceace66
                                                                                                                                                                • Opcode Fuzzy Hash: f0d9bc7f0e679cec2104f3f9c7fca803576070b2f939deec827ebffe3375700d
                                                                                                                                                                • Instruction Fuzzy Hash: 29419273B28A8686EB50CF25E8402AA67A1FB86FA0F505235EE5DC36D5DF3CD944C740
                                                                                                                                                                Function 00007FF677B30AF0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32registryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 1056 7ff677b30af0-7ff677b30b28 RegOpenKeyExW 1057 7ff677b30b2a-7ff677b30b3e RegOverridePredefKey 1056->1057 1058 7ff677b30b40-7ff677b30b4e 1056->1058 1057->1058 1059 7ff677b30b50 1057->1059 1060 7ff677b30b52-7ff677b30b5a 1058->1060 1059->1060 1061 7ff677b30b5c RegCloseKey 1060->1061 1062 7ff677b30b62-7ff677b30b69 1060->1062 1061->1062
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseOpenOverridePredef
                                                                                                                                                                • String ID: Software\Classes
                                                                                                                                                                • API String ID: 2630863477-1656466771
                                                                                                                                                                • Opcode ID: d75ca46f8bbd70cb0832b32f21674b070b5aaf5ea9ada09fa22877e658fd243d
                                                                                                                                                                • Instruction ID: b171c2093dde97f0a32b882a425d819e58207ba2007a025add701fd0deddb262
                                                                                                                                                                • Opcode Fuzzy Hash: d75ca46f8bbd70cb0832b32f21674b070b5aaf5ea9ada09fa22877e658fd243d
                                                                                                                                                                • Instruction Fuzzy Hash: D1F04432B3860646EB508F79E49073752A4EF46FA4F540234EEADC66D4EF2CD5849610
                                                                                                                                                                Function 00007FF677B15170 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 147COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • InitializeCriticalSection.KERNEL32(?,?,?,?,00007FF677B11009), ref: 00007FF677B151B8
                                                                                                                                                                  • Part of subcall function 00007FF677B1156C: GetProcessHeap.KERNEL32(?,?,?,00007FF677B15186,?,?,?,?,00007FF677B11009), ref: 00007FF677B115E2
                                                                                                                                                                  • Part of subcall function 00007FF677B1156C: _Init_thread_footer.LIBCMT ref: 00007FF677B11617
                                                                                                                                                                  • Part of subcall function 00007FF677B1156C: _Init_thread_footer.LIBCMT ref: 00007FF677B11680
                                                                                                                                                                  • Part of subcall function 00007FF677B180CC: GetEnvironmentVariableW.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF677B15229,?,?,?,?,00007FF677B11009), ref: 00007FF677B18174
                                                                                                                                                                  • Part of subcall function 00007FF677B180CC: GetEnvironmentVariableW.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF677B15229,?,?,?,?,00007FF677B11009), ref: 00007FF677B181AA
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: EnvironmentInit_thread_footerVariable$CriticalHeapInitializeProcessSection
                                                                                                                                                                • String ID: AVGBrowserUpdate.ini$AVGBrowserUpdate.log$SystemDrive
                                                                                                                                                                • API String ID: 3489650459-510794757
                                                                                                                                                                • Opcode ID: 10adbc473e787a35bf78dc58a698421da8456339033558034ce7ec74d1b2d45e
                                                                                                                                                                • Instruction ID: faaefd81b0d5ace2fc907ba1a5122121729e2a064d792008ae3f41c52c6391de
                                                                                                                                                                • Opcode Fuzzy Hash: 10adbc473e787a35bf78dc58a698421da8456339033558034ce7ec74d1b2d45e
                                                                                                                                                                • Instruction Fuzzy Hash: 25713D33B38A4691EB04DF28E8853682760FF82F54F904236DA6E876E5DF6CE558C740
                                                                                                                                                                Function 00007FF677B31024 Relevance: 6.1, APIs: 4, Instructions: 94COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: __scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2338475965-0
                                                                                                                                                                • Opcode ID: 5e5889dfb5eaba0c422bfd858552b7ada08143931e332f86730c26a643078a0d
                                                                                                                                                                • Instruction ID: e2c9f0e85304e104f3ef4da304d614b7d18633bf4af7684ba5eb72c181feb8e6
                                                                                                                                                                • Opcode Fuzzy Hash: 5e5889dfb5eaba0c422bfd858552b7ada08143931e332f86730c26a643078a0d
                                                                                                                                                                • Instruction Fuzzy Hash: 9F316F37E2D94B82FA14AF7494513F92295EF83F84F548835DE0DCB6D7DE2DA8848240
                                                                                                                                                                Function 00007FF677B2083C Relevance: 6.1, APIs: 4, Instructions: 54COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FF677B20A6B), ref: 00007FF677B20880
                                                                                                                                                                • LeaveCriticalSection.KERNEL32(?,?,00000008,00007FF677B22FC3), ref: 00007FF677B208D5
                                                                                                                                                                • InitializeCriticalSection.KERNEL32(?,?,00000008,00007FF677B22FC3), ref: 00007FF677B2091D
                                                                                                                                                                • _Init_thread_footer.LIBCMT ref: 00007FF677B20936
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CriticalSection$EnterInit_thread_footerInitializeLeave
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3638806434-0
                                                                                                                                                                • Opcode ID: 1a83540283a8429459bd80d205bc646a55799d22854ba1e1f0fb4beda5fca6b3
                                                                                                                                                                • Instruction ID: b2187a98ccbb9f304214ee628cbacfcdcf6ee20645d817f9b8bd2572c355f7b8
                                                                                                                                                                • Opcode Fuzzy Hash: 1a83540283a8429459bd80d205bc646a55799d22854ba1e1f0fb4beda5fca6b3
                                                                                                                                                                • Instruction Fuzzy Hash: 0121A972A2EA4795FA50EF25E8841752364EF96F54F804136CD0DC72B1EF2CE989C380
                                                                                                                                                                Function 00007FF677B21F58 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00007FF677B22614: GetPrivateProfileStringW.KERNEL32 ref: 00007FF677B226A1
                                                                                                                                                                • _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF677B2217C
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: PrivateProfileString_invalid_parameter_noinfo_noreturn
                                                                                                                                                                • String ID: DevMode$EndPoint
                                                                                                                                                                • API String ID: 948732310-1150194814
                                                                                                                                                                • Opcode ID: a9a8d7d3c3ab88226399fe6d6c31ee0ed3c036d07055120b8f07f1fbae79cb0f
                                                                                                                                                                • Instruction ID: e01b024f16563c16d1532790bb30c841ea76e2ae6803cf6f4647083c60270be9
                                                                                                                                                                • Opcode Fuzzy Hash: a9a8d7d3c3ab88226399fe6d6c31ee0ed3c036d07055120b8f07f1fbae79cb0f
                                                                                                                                                                • Instruction Fuzzy Hash: E9617D33A29B8282EB14DF24E8402AD23A0FB46B94F414535EF8D83B99DF3CD545C740
                                                                                                                                                                Function 00007FF677B22614 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Init_thread_footerPrivateProfileString
                                                                                                                                                                • String ID: Global
                                                                                                                                                                • API String ID: 2804049157-4020866741
                                                                                                                                                                • Opcode ID: 225c49344fd07bb1c84e2afd8cb1a158ea18e18f2248343645abf914feec83ff
                                                                                                                                                                • Instruction ID: 21f83da838ef3bd8f125beaeeae50089236f34916c14f067cb4bd9e3f67293e4
                                                                                                                                                                • Opcode Fuzzy Hash: 225c49344fd07bb1c84e2afd8cb1a158ea18e18f2248343645abf914feec83ff
                                                                                                                                                                • Instruction Fuzzy Hash: 5C316F37B29A8282EB10DF29E4501B96361EF86F88F558132DE0DC7BA5DF3CE4558744
                                                                                                                                                                Function 00007FF677B111FC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID: [Global::GetSingleInstance]$common\global.cc
                                                                                                                                                                • API String ID: 0-2777345810
                                                                                                                                                                • Opcode ID: 14cd6f331330d016ea3740787e8381a6da0cb506ca6d6e5f815e76d79d7cfedc
                                                                                                                                                                • Instruction ID: f006f7e06522b756980f14541d94dbd1f8d4ed00311524323ef787138cc6d476
                                                                                                                                                                • Opcode Fuzzy Hash: 14cd6f331330d016ea3740787e8381a6da0cb506ca6d6e5f815e76d79d7cfedc
                                                                                                                                                                • Instruction Fuzzy Hash: 4A311977E29A4682EA00DF24E8911B83764FF96B48F804236DD5DC76A5EF3CE594C740
                                                                                                                                                                Function 00007FF677B21E88 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: DeleteFileInit_thread_footer
                                                                                                                                                                • String ID: HKLM\Software\AVG\Browser\Update\
                                                                                                                                                                • API String ID: 884701936-2356444412
                                                                                                                                                                • Opcode ID: 3443eb4d094f4825b88fd2d024e495795b6484fdb643dd19ff9d26be15095c72
                                                                                                                                                                • Instruction ID: e3886fb50692137506b5fcfa6f2b9f11356071712a1bc994764a3e6e0bc3c8d8
                                                                                                                                                                • Opcode Fuzzy Hash: 3443eb4d094f4825b88fd2d024e495795b6484fdb643dd19ff9d26be15095c72
                                                                                                                                                                • Instruction Fuzzy Hash: DD211073A2994682EB04DF39DC451682760FB86F58F544632DE2DC76E5DF2CD889C780
                                                                                                                                                                Function 00007FF677B1BC70 Relevance: 4.6, APIs: 3, Instructions: 69registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: lstrcmpi$Close$OpenQueryValue
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 645971292-0
                                                                                                                                                                • Opcode ID: 1bcd5ba61b15772b5b5fb1845798cf6b0f104dec65e70439da22705724269505
                                                                                                                                                                • Instruction ID: d3677370557841cd33ae4dd7b5435fcea7406df592a92928d93e94d585c79e1e
                                                                                                                                                                • Opcode Fuzzy Hash: 1bcd5ba61b15772b5b5fb1845798cf6b0f104dec65e70439da22705724269505
                                                                                                                                                                • Instruction Fuzzy Hash: 0A31CD73B24A4586FB10CF60E805BAE2770FB46B88F444635EE1D93A59DF38C6858340
                                                                                                                                                                Function 00007FF677B46F44 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Process$CurrentExitTerminate
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1703294689-0
                                                                                                                                                                • Opcode ID: 26b9e005e265d9f365cc72195985c729957976abc9dd0539324da40abd737e2d
                                                                                                                                                                • Instruction ID: 30256ba17e2e9a8fc37f157241ac0a983fd7254bb8d9d9387b36689b56a051cf
                                                                                                                                                                • Opcode Fuzzy Hash: 26b9e005e265d9f365cc72195985c729957976abc9dd0539324da40abd737e2d
                                                                                                                                                                • Instruction Fuzzy Hash: 9CD01772F2824242EB082F30A84403D02510F8FF19F001438CC8E8A3A2CE3EA48D4210
                                                                                                                                                                Function 00007FF677B2F9E8 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 261COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ArgvCommandLine_cwprintf_s_l
                                                                                                                                                                • String ID: scenario_%Iu
                                                                                                                                                                • API String ID: 3692461839-3175859577
                                                                                                                                                                • Opcode ID: e7cc19f7d4b99850296715f0009a4fa00737ac2408a9d065f6f324eb9495d9ff
                                                                                                                                                                • Instruction ID: bc3e209fe64ab5618585777dd19d760def7f7496a0b9f239dc684ba472b32e4b
                                                                                                                                                                • Opcode Fuzzy Hash: e7cc19f7d4b99850296715f0009a4fa00737ac2408a9d065f6f324eb9495d9ff
                                                                                                                                                                • Instruction Fuzzy Hash: A7B19B33B16B4686EB04DF6AC5502AD23A1FB46FD8B444532DE1D9BB99DF38E44AC340
                                                                                                                                                                Function 00007FF677B1B998 Relevance: 3.1, APIs: 2, Instructions: 60COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SHQueryValueExW.SHLWAPI(?,?,00000000,00000001,00000001,00007FF677B1B71D), ref: 00007FF677B1B9D6
                                                                                                                                                                • SHQueryValueExW.SHLWAPI(?,?,00000000,00000001,00000001,00007FF677B1B71D), ref: 00007FF677B1BA36
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: QueryValue
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3660427363-0
                                                                                                                                                                • Opcode ID: f054a759115cc88c3076ce0f86967040e899a41ef16ce16665ff685ac8b74547
                                                                                                                                                                • Instruction ID: 4eb8459333ff0dd24593be8442ae55146bae9eee728fa992be061403a0633c50
                                                                                                                                                                • Opcode Fuzzy Hash: f054a759115cc88c3076ce0f86967040e899a41ef16ce16665ff685ac8b74547
                                                                                                                                                                • Instruction Fuzzy Hash: E521AE33614B8186EB10DF65F4889AAB3A8FB8AB90B510135EF9D83710DF39C955C704
                                                                                                                                                                Function 00007FF677B11E78 Relevance: 1.6, APIs: 1, Instructions: 146COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: ddd255031e7573ae1cd0d6a97667de34261272744f6d8f3cd02361d395212ca5
                                                                                                                                                                • Instruction ID: 5189ce8040c8ea61645f243600c1d47cac468b7bbf4df1845744fc70f54873ed
                                                                                                                                                                • Opcode Fuzzy Hash: ddd255031e7573ae1cd0d6a97667de34261272744f6d8f3cd02361d395212ca5
                                                                                                                                                                • Instruction Fuzzy Hash: A5519D37B18A46C6EA149F66E4445BD6760FB85F80F55853ADF0C87B92CF38E491C740
                                                                                                                                                                Function 00007FF677B1BFF4 Relevance: 1.6, APIs: 1, Instructions: 104COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Close$_invalid_parameter_noinfo
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 434093202-0
                                                                                                                                                                • Opcode ID: 95436974236d016e7e08d7dca4a9d323b59fbf80409453a0a9946a40c96ce9cb
                                                                                                                                                                • Instruction ID: 931c48b05261a5db28f659bd563d4f372dda2d1b96a0fd2626d0f45f2a33971b
                                                                                                                                                                • Opcode Fuzzy Hash: 95436974236d016e7e08d7dca4a9d323b59fbf80409453a0a9946a40c96ce9cb
                                                                                                                                                                • Instruction Fuzzy Hash: 6B31BF37B28B8686EA10EF6AA94517D67A0FF82F84F518035DF0D97742DE3DE4928340
                                                                                                                                                                Function 00007FF677B122F0 Relevance: 1.6, APIs: 1, Instructions: 94COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3215553584-0
                                                                                                                                                                • Opcode ID: c1879d1b32f747df3f656f95859534daa3db35cdf89468fef1e3804989f05c98
                                                                                                                                                                • Instruction ID: f8038d3f3548d815d6bc961e0f567d58fbf8fafbafa81ac7c55efa4a8b54233d
                                                                                                                                                                • Opcode Fuzzy Hash: c1879d1b32f747df3f656f95859534daa3db35cdf89468fef1e3804989f05c98
                                                                                                                                                                • Instruction Fuzzy Hash: 5D31AB37B24B09C6EB149F66E4001AC77A0FB89F90B598032DF4C87B95DE38E481C740
                                                                                                                                                                Function 00007FF677B46E75 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3947729631-0
                                                                                                                                                                • Opcode ID: 5f70f49ea4d59bda444a88cc10e29890d7a12384065a645bd07791689e740117
                                                                                                                                                                • Instruction ID: ce9132c36048a77387e641731fb0a9a18cd95be7f2a1cb9458f6cabedd4d1a8c
                                                                                                                                                                • Opcode Fuzzy Hash: 5f70f49ea4d59bda444a88cc10e29890d7a12384065a645bd07791689e740117
                                                                                                                                                                • Instruction Fuzzy Hash: D0217C72A24B0599EB24CF64D4842EC33E0EB49B1CF44463ADB6D86ED5DF39D485C744
                                                                                                                                                                Function 00007FF677B1168C Relevance: 1.5, APIs: 1, Instructions: 46memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocateHeap
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1279760036-0
                                                                                                                                                                • Opcode ID: c9d1414b02aa421ebe8d7d0f41605f278328a733d919ba9ed5a3749784dd1864
                                                                                                                                                                • Instruction ID: 7a73f9455a2273cbb4bb48382bb04a299970b43f636bda692318660811a96ce9
                                                                                                                                                                • Opcode Fuzzy Hash: c9d1414b02aa421ebe8d7d0f41605f278328a733d919ba9ed5a3749784dd1864
                                                                                                                                                                • Instruction Fuzzy Hash: 9F016173A2C74686EB548F29D4942297294EBC2F75B288735DA39C27D4DF69D8848700
                                                                                                                                                                Function 00007FF677B1ADC0 Relevance: 1.5, APIs: 1, Instructions: 40registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Open
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 71445658-0
                                                                                                                                                                • Opcode ID: 2052654daafafd6641aa1d72e4753db744e5f8f89eef047c420d866672474279
                                                                                                                                                                • Instruction ID: 227326df4d129ae61dd4faf133dbeb29d26ba422bf98b4131aceeddf35467bec
                                                                                                                                                                • Opcode Fuzzy Hash: 2052654daafafd6641aa1d72e4753db744e5f8f89eef047c420d866672474279
                                                                                                                                                                • Instruction Fuzzy Hash: E701A233B24B5082D7448B26F85576AA291F7D9B98F19D235EE9A87758EF3CC8018700
                                                                                                                                                                Function 00007FF677B4AB00 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RtlAllocateHeap.NTDLL(?,?,00000000,00007FF677B4A93E,?,?,00000004,00007FF677B3942D,?,?,?,?,00007FF677B4CD06,?,?,00000000), ref: 00007FF677B4AB55
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocateHeap
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1279760036-0
                                                                                                                                                                • Opcode ID: e85f946e4304516bf1e6a0491476484c14b7b78d7d494d7b4e8f2a38ee091e45
                                                                                                                                                                • Instruction ID: c396d9dac63ef336d45dbeee0da187d2f1d1562223e18128d1c1e3e44131aa4f
                                                                                                                                                                • Opcode Fuzzy Hash: e85f946e4304516bf1e6a0491476484c14b7b78d7d494d7b4e8f2a38ee091e45
                                                                                                                                                                • Instruction Fuzzy Hash: 61F06D72F3A20681FE645F65A8513B51286AF8AF80F485431DD0ECA3C2EE2CE8809215
                                                                                                                                                                Function 00007FF677B1B950 Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: QueryValue
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3660427363-0
                                                                                                                                                                • Opcode ID: 5a598c1e29b72cf198c095c8f18fdc8da177d6623ff05d95944b06571cad1283
                                                                                                                                                                • Instruction ID: eb345893604aeebd5e2eb2a0d9a872ecd15925965f5fdc3a76ca045b96780c64
                                                                                                                                                                • Opcode Fuzzy Hash: 5a598c1e29b72cf198c095c8f18fdc8da177d6623ff05d95944b06571cad1283
                                                                                                                                                                • Instruction Fuzzy Hash: 05E0DF36310A80C6E704CF20E4197AD33A4F340784FA00039CB5C82320CF3EC956CB00
                                                                                                                                                                Function 00007FF677B4AA64 Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: __vcrt_uninitialize_ptd
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1180542099-0
                                                                                                                                                                • Opcode ID: bcc605e5acd30f996d282146d50d7c0f9cb391c07aef0befb03029b60025475a
                                                                                                                                                                • Instruction ID: 77c09dad764e8eadea3204e79a9bec46bdddb7d8d8ad98fc25646681d149706d
                                                                                                                                                                • Opcode Fuzzy Hash: bcc605e5acd30f996d282146d50d7c0f9cb391c07aef0befb03029b60025475a
                                                                                                                                                                • Instruction Fuzzy Hash: 71E0E277D3D20395F9656F305A860BA23A02F27B10F901A36DC1EC22D2EE2DB5067692
                                                                                                                                                                Function 00007FF677B1C31C Relevance: 1.5, APIs: 1, Instructions: 15registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: OverridePredef
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 898253552-0
                                                                                                                                                                • Opcode ID: 5d17cd3dd8a689ff32e8fd5c6309d9fc0c707e7dee8c8df72c56f5ca389957e8
                                                                                                                                                                • Instruction ID: 960f519f9ce8718ddb77b9d987c30c4d5abd0ae23dce5378684516be2300a192
                                                                                                                                                                • Opcode Fuzzy Hash: 5d17cd3dd8a689ff32e8fd5c6309d9fc0c707e7dee8c8df72c56f5ca389957e8
                                                                                                                                                                • Instruction Fuzzy Hash: 9FD0C731B3A65381EF48573B1C5033650D15F85A71F944634DD6DC02D4EE1CD4455114
                                                                                                                                                                Function 00007FF677B14EB0 Relevance: 1.3, APIs: 1, Instructions: 65stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00007FF677B11ACC: PathRemoveExtensionW.SHLWAPI(?,?,?,?,?,?,?,?,00000000,0100000000000068,?,00007FF677B14ECE,?,?,0100000000000068,00007FF677B15C50), ref: 00007FF677B11B2E
                                                                                                                                                                  • Part of subcall function 00007FF677B11890: VirtualQuery.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FF677B11C7A), ref: 00007FF677B118B7
                                                                                                                                                                • lstrcmpiW.KERNELBASE(?,?,0100000000000068,00007FF677B15C50,?,?,?,?,0100000000000000,00007FF677B15D46,?,?,00000001,00007FF677B15E83), ref: 00007FF677B14F0C
                                                                                                                                                                  • Part of subcall function 00007FF677B17378: _invalid_parameter_noinfo.LIBCMT ref: 00007FF677B17447
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExtensionPathQueryRemoveVirtual_invalid_parameter_noinfolstrcmpi
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 433467565-0
                                                                                                                                                                • Opcode ID: ab708ead5eb87360329c838e487ba261d9cd184ee6ed88356eb8a21d33daa7f3
                                                                                                                                                                • Instruction ID: 04ab5d9ab66d582b36a225f88f107f62c15947af1f4f21ec9ba29b683ff2b083
                                                                                                                                                                • Opcode Fuzzy Hash: ab708ead5eb87360329c838e487ba261d9cd184ee6ed88356eb8a21d33daa7f3
                                                                                                                                                                • Instruction Fuzzy Hash: B5213133B28A4682EB049F26E84116D63A1FB86FD0B484435EF5DC7B69EF2CD9858740

                                                                                                                                                                Non-executed Functions

                                                                                                                                                                Function 00007FF677B15414 Relevance: 42.2, APIs: 10, Strings: 14, Instructions: 210COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: PrivateProfile$String
                                                                                                                                                                • String ID: AVGBrowserUpdate.log$AVG\Browser\Update\Log$AppendToFile$EnableLogging$LogFilePath$LogToFile$LogToOutputDebug$LoggingLevel$LoggingSettings$ShowCatAndLevel$ShowPidAndTid$ShowSourceFile$ShowTime$base\utils.cc
                                                                                                                                                                • API String ID: 83056003-3477150836
                                                                                                                                                                • Opcode ID: 42659b81751aa84dd05992f5ea32abf816aa1e012faa623bfcbc38a31b778486
                                                                                                                                                                • Instruction ID: 16c70b171d0e3a42dab6024537b4d013605b29834320d1818b7cde3506a08415
                                                                                                                                                                • Opcode Fuzzy Hash: 42659b81751aa84dd05992f5ea32abf816aa1e012faa623bfcbc38a31b778486
                                                                                                                                                                • Instruction Fuzzy Hash: 7E819E77B2864686EB10DF29E844AA927A1FB46F98F458536DE1DC32A4EF3CD548C700
                                                                                                                                                                Function 00007FF677B29FFC Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 320synchronizationfileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _invalid_parameter_noinfo_noreturn$CriticalSection$DebugFileProcess$BreakCurrentDebuggerEnterInitializeLeaveMutexObjectOutputPointerPresentReleaseSingleStringTerminateWaitWrite
                                                                                                                                                                • String ID: Check failed: r != WAIT_ABANDONED. $base\logging\logging.cc
                                                                                                                                                                • API String ID: 1161433839-2055314134
                                                                                                                                                                • Opcode ID: 2383b75c1aba821f097b91944c86a7c54ad13a25359a0d21437db18fcbb593f2
                                                                                                                                                                • Instruction ID: 6fe7ad5080a529c7479a68547f5e557a5f34732c721d5b0c2d3db120cce14970
                                                                                                                                                                • Opcode Fuzzy Hash: 2383b75c1aba821f097b91944c86a7c54ad13a25359a0d21437db18fcbb593f2
                                                                                                                                                                • Instruction Fuzzy Hash: A3E13933A29A8685EB10DF39D4942BD2761EB46FA8F504132DE1D97BA9CF3CE485C340
                                                                                                                                                                Function 00007FF677B1C148 Relevance: 13.5, APIs: 9, Instructions: 42clipboardmemorystringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,devmode,?,HKLM\Software\AVG\Browser\Update\,00007FF677B1BCA4), ref: 00007FF677B1C15A
                                                                                                                                                                • OpenClipboard.USER32 ref: 00007FF677B1C164
                                                                                                                                                                • EmptyClipboard.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,devmode,?,HKLM\Software\AVG\Browser\Update\,00007FF677B1BCA4), ref: 00007FF677B1C16E
                                                                                                                                                                • GlobalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,devmode,?,HKLM\Software\AVG\Browser\Update\,00007FF677B1BCA4), ref: 00007FF677B1C185
                                                                                                                                                                • GlobalLock.KERNEL32 ref: 00007FF677B1C191
                                                                                                                                                                • GlobalUnlock.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,devmode,?,HKLM\Software\AVG\Browser\Update\,00007FF677B1BCA4), ref: 00007FF677B1C1AD
                                                                                                                                                                • SetClipboardData.USER32 ref: 00007FF677B1C1BB
                                                                                                                                                                • GlobalFree.KERNEL32 ref: 00007FF677B1C1C9
                                                                                                                                                                • CloseClipboard.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,devmode,?,HKLM\Software\AVG\Browser\Update\,00007FF677B1BCA4), ref: 00007FF677B1C1CF
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ClipboardGlobal$AllocCloseDataEmptyFreeLockOpenUnlocklstrlen
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2633044538-0
                                                                                                                                                                • Opcode ID: 9d21f1e813dc6169012e1c4b5b3008f562fcfef1972ec5991ae3327543abeb0e
                                                                                                                                                                • Instruction ID: 8c1d5060b0baa505735dc737cd93c7ecc718665527206e5e12a32105253f2ab3
                                                                                                                                                                • Opcode Fuzzy Hash: 9d21f1e813dc6169012e1c4b5b3008f562fcfef1972ec5991ae3327543abeb0e
                                                                                                                                                                • Instruction Fuzzy Hash: 7001E932B2974682EA485F62F95813A63A1EF4BFC1F084039DD0E97B95DF3CE4958600
                                                                                                                                                                Function 00007FF677B1E5AC Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 355COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: swprintf$_invalid_parameter_noinfo_noreturn
                                                                                                                                                                • String ID: %
                                                                                                                                                                • API String ID: 759536258-2567322570
                                                                                                                                                                • Opcode ID: 07d63cbdf786ba385b084db5f45a8f88e1f7cb1023afdec8658c855ec8b099a9
                                                                                                                                                                • Instruction ID: c1dd61c617420f7ee56efd144aa49e8bb80f36aeaa678455b289e6d0004a15e1
                                                                                                                                                                • Opcode Fuzzy Hash: 07d63cbdf786ba385b084db5f45a8f88e1f7cb1023afdec8658c855ec8b099a9
                                                                                                                                                                • Instruction Fuzzy Hash: BCE1D133B28A858AFB148FB5D4503FD63A1EB8AB98F444635DE4C97B99DE3CE1458340
                                                                                                                                                                Function 00007FF677B52904 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLastNameTranslate$CodePageValidValue
                                                                                                                                                                • String ID: utf8
                                                                                                                                                                • API String ID: 1791977518-905460609
                                                                                                                                                                • Opcode ID: 11f6e6cc199a1cd2c00f1c8e40000f0b754e163aa3a66438480ef9f0789ff7ad
                                                                                                                                                                • Instruction ID: 916763afcd98e43c525a7d5516419c619b5d9ec602aea6cdb5cd6bd96e1c5e0e
                                                                                                                                                                • Opcode Fuzzy Hash: 11f6e6cc199a1cd2c00f1c8e40000f0b754e163aa3a66438480ef9f0789ff7ad
                                                                                                                                                                • Instruction Fuzzy Hash: B3917BB3A2A78286EB249F21E5412F923A4EB4AF84F448131DE4DC7785EF3CE595C700
                                                                                                                                                                Function 00007FF677B53338 Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2591520935-0
                                                                                                                                                                • Opcode ID: d52e3f24b2c11d9291cfd15194209567efd87b681933a23ba5d5a5af1625b26c
                                                                                                                                                                • Instruction ID: d9eb2d1470767b600c5a6c8ce0f6cb266a0b037d7b5f81558b560853e9ec8e4e
                                                                                                                                                                • Opcode Fuzzy Hash: d52e3f24b2c11d9291cfd15194209567efd87b681933a23ba5d5a5af1625b26c
                                                                                                                                                                • Instruction Fuzzy Hash: 84714773B286428AFB619F61E8606B927A0BB4AF48F444435CE0D97795EF3CE589C350
                                                                                                                                                                Function 00007FF677B31ABC Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3140674995-0
                                                                                                                                                                • Opcode ID: fd3ea78788153a1062d09bae0b73fa5f8da36dc3def2b7c93eb344394da83fc7
                                                                                                                                                                • Instruction ID: 6d18d5d1101182374f7210f4e56b3063145e56838c193ebe28f271af67b8ba8f
                                                                                                                                                                • Opcode Fuzzy Hash: fd3ea78788153a1062d09bae0b73fa5f8da36dc3def2b7c93eb344394da83fc7
                                                                                                                                                                • Instruction Fuzzy Hash: A5311E73619F858AEB609F60E8403EE7365FB86B44F444439DA4E97B98EF38D588C710
                                                                                                                                                                Function 00007FF677B4D690 Relevance: 9.3, APIs: 6, Instructions: 335timeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • _get_daylight.LIBCMT ref: 00007FF677B4D6D5
                                                                                                                                                                  • Part of subcall function 00007FF677B4D030: _invalid_parameter_noinfo.LIBCMT ref: 00007FF677B4D044
                                                                                                                                                                  • Part of subcall function 00007FF677B4AAC4: HeapFree.KERNEL32(?,?,00007FF677B48A35,00007FF677B5163A,?,?,?,00007FF677B519B7,?,?,00000000,00007FF677B51F98,?,?,?,00007FF677B51ECB), ref: 00007FF677B4AADA
                                                                                                                                                                  • Part of subcall function 00007FF677B4AAC4: GetLastError.KERNEL32(?,?,00007FF677B48A35,00007FF677B5163A,?,?,?,00007FF677B519B7,?,?,00000000,00007FF677B51F98,?,?,?,00007FF677B51ECB), ref: 00007FF677B4AAE4
                                                                                                                                                                  • Part of subcall function 00007FF677B39308: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF677B392B6,?,?,?,?,?,00007FF677B3919E), ref: 00007FF677B39311
                                                                                                                                                                  • Part of subcall function 00007FF677B39308: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF677B392B6,?,?,?,?,?,00007FF677B3919E), ref: 00007FF677B39336
                                                                                                                                                                  • Part of subcall function 00007FF677B56538: _invalid_parameter_noinfo.LIBCMT ref: 00007FF677B56483
                                                                                                                                                                • _get_daylight.LIBCMT ref: 00007FF677B4D6C4
                                                                                                                                                                  • Part of subcall function 00007FF677B4D090: _invalid_parameter_noinfo.LIBCMT ref: 00007FF677B4D0A4
                                                                                                                                                                • _get_daylight.LIBCMT ref: 00007FF677B4D93A
                                                                                                                                                                • _get_daylight.LIBCMT ref: 00007FF677B4D94B
                                                                                                                                                                • _get_daylight.LIBCMT ref: 00007FF677B4D95C
                                                                                                                                                                • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF677B4DB9C), ref: 00007FF677B4D983
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4070488512-0
                                                                                                                                                                • Opcode ID: 6adc986156a2fce6a584edac0777e7dee24d988e5698e4d1758f43f9a3d37cb5
                                                                                                                                                                • Instruction ID: 62fd12d8fd51b566f709b42f532c5d36669fef97ab14bd6192959a3f1898a429
                                                                                                                                                                • Opcode Fuzzy Hash: 6adc986156a2fce6a584edac0777e7dee24d988e5698e4d1758f43f9a3d37cb5
                                                                                                                                                                • Instruction Fuzzy Hash: 07D1AE37B2864286EB60AF21D8942B967A1FF86F84F844136EF4DC7B85DE3CE4519740
                                                                                                                                                                Function 00007FF677B3FD54 Relevance: 9.2, APIs: 6, Instructions: 224COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _get_daylight$_isindst$_invalid_parameter_noinfo
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1405656091-0
                                                                                                                                                                • Opcode ID: 70f134de721169bf8069206ad4afa3796b6b9e851231e13886bb59c7f7030be0
                                                                                                                                                                • Instruction ID: d6643a5aec9d50110fbea66c5ebaf7bfe78a7e81e8e6d5a09b5c5a766eb19f7e
                                                                                                                                                                • Opcode Fuzzy Hash: 70f134de721169bf8069206ad4afa3796b6b9e851231e13886bb59c7f7030be0
                                                                                                                                                                • Instruction Fuzzy Hash: 8D81B3B3B142468BEB588F35C9453B827A5EB55F88F449139DE0DCA78AEF3CE5418740
                                                                                                                                                                Function 00007FF677B38FE8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1239891234-0
                                                                                                                                                                • Opcode ID: 45c37dc97ec2d117dcb65e0af4c1637a4ab967070eab4d119f07e576c7707055
                                                                                                                                                                • Instruction ID: 85d1c23615a0237373a93c533fd2c34fe4f0ba6128045d6121b08f2e2a53ad47
                                                                                                                                                                • Opcode Fuzzy Hash: 45c37dc97ec2d117dcb65e0af4c1637a4ab967070eab4d119f07e576c7707055
                                                                                                                                                                • Instruction Fuzzy Hash: CB313D33628F8196DB608F35E8402AE77A4FB8AB98F540135EE9D83B55DF38D595CB00
                                                                                                                                                                Function 00007FF677B30DEC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF677B30E6F
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
                                                                                                                                                                • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                                                                                                • API String ID: 450123788-631824599
                                                                                                                                                                • Opcode ID: c19ed4b579dcb148392152c4980dc3df46b9ea429a11d711d88157fe9aabebbf
                                                                                                                                                                • Instruction ID: 62aaf068e9aee7a27329b07e0874270b02d37fb7ddc6ee0dfe3b26259bbd32e2
                                                                                                                                                                • Opcode Fuzzy Hash: c19ed4b579dcb148392152c4980dc3df46b9ea429a11d711d88157fe9aabebbf
                                                                                                                                                                • Instruction Fuzzy Hash: 18113D33A24B96A7F7449F22E55437932A5FF49B44F404135CA4D82A50EF3DE0A48750
                                                                                                                                                                Function 00007FF677B17650 Relevance: 7.6, APIs: 5, Instructions: 133COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?,?,?,?,?,00000000,00007FF677B17B89), ref: 00007FF677B176AC
                                                                                                                                                                • InitializeSecurityDescriptor.ADVAPI32(?,?,?,?,?,?,?,?,00000000,00007FF677B17B89), ref: 00007FF677B176D9
                                                                                                                                                                • GetAclInformation.ADVAPI32(?,?,?,?,?,?,?,?,00000000,00007FF677B17B89), ref: 00007FF677B1771D
                                                                                                                                                                • SetSecurityDescriptorDacl.ADVAPI32(?,?,?,?,?,?,?,?,00000000,00007FF677B17B89), ref: 00007FF677B17781
                                                                                                                                                                  • Part of subcall function 00007FF677B17834: GetSecurityDescriptorControl.ADVAPI32 ref: 00007FF677B17868
                                                                                                                                                                  • Part of subcall function 00007FF677B17834: MakeAbsoluteSD.ADVAPI32 ref: 00007FF677B178D9
                                                                                                                                                                  • Part of subcall function 00007FF677B17834: GetLastError.KERNEL32 ref: 00007FF677B178DF
                                                                                                                                                                • _invalid_parameter_noinfo.LIBCMT ref: 00007FF677B1780C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: DescriptorSecurity$Dacl$AbsoluteControlErrorInformationInitializeLastMake_invalid_parameter_noinfo
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 558418638-0
                                                                                                                                                                • Opcode ID: 529e0da3bab7acc0558ad61d5317bf223ba39ee2b3371931870326b9facedfca
                                                                                                                                                                • Instruction ID: 89da943fcf8d77f5c0f273d60c61f8298ba86c2eb251681b2035a0e0025da448
                                                                                                                                                                • Opcode Fuzzy Hash: 529e0da3bab7acc0558ad61d5317bf223ba39ee2b3371931870326b9facedfca
                                                                                                                                                                • Instruction Fuzzy Hash: 2D519F33A2878746FA24EF72A51477A6290AF86F80F044439DE5EC7B96DE3CE9458340
                                                                                                                                                                Function 00007FF677B433E0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 329COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: memcpy_s
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1502251526-3916222277
                                                                                                                                                                • Opcode ID: 3602807880ed2ce2b152c36a3384a2935830a13650ce077ef140dc90abb17255
                                                                                                                                                                • Instruction ID: 3f1a3ef15d71ee920bbefa64b4ebe9bc33a6247cb2ffbcbe314b391a6d693d96
                                                                                                                                                                • Opcode Fuzzy Hash: 3602807880ed2ce2b152c36a3384a2935830a13650ce077ef140dc90abb17255
                                                                                                                                                                • Instruction Fuzzy Hash: 73C1B373A2968687E760CF19E048A6AB791F795B84F098135DF4A97744DF3CE809DB00
                                                                                                                                                                Function 00007FF677B4D90C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • _get_daylight.LIBCMT ref: 00007FF677B4D93A
                                                                                                                                                                  • Part of subcall function 00007FF677B4D090: _invalid_parameter_noinfo.LIBCMT ref: 00007FF677B4D0A4
                                                                                                                                                                • _get_daylight.LIBCMT ref: 00007FF677B4D94B
                                                                                                                                                                  • Part of subcall function 00007FF677B4D030: _invalid_parameter_noinfo.LIBCMT ref: 00007FF677B4D044
                                                                                                                                                                • _get_daylight.LIBCMT ref: 00007FF677B4D95C
                                                                                                                                                                  • Part of subcall function 00007FF677B4D060: _invalid_parameter_noinfo.LIBCMT ref: 00007FF677B4D074
                                                                                                                                                                  • Part of subcall function 00007FF677B4AAC4: HeapFree.KERNEL32(?,?,00007FF677B48A35,00007FF677B5163A,?,?,?,00007FF677B519B7,?,?,00000000,00007FF677B51F98,?,?,?,00007FF677B51ECB), ref: 00007FF677B4AADA
                                                                                                                                                                  • Part of subcall function 00007FF677B4AAC4: GetLastError.KERNEL32(?,?,00007FF677B48A35,00007FF677B5163A,?,?,?,00007FF677B519B7,?,?,00000000,00007FF677B51F98,?,?,?,00007FF677B51ECB), ref: 00007FF677B4AAE4
                                                                                                                                                                • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF677B4DB9C), ref: 00007FF677B4D983
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3458911817-0
                                                                                                                                                                • Opcode ID: eb7ef735fef142aa37c3edaa2482454292f0641f988a23163b716aa803a854f5
                                                                                                                                                                • Instruction ID: 8ec6d50cc724b1474a6afd90bf84cb02e21563732d741e2d5d33db08ca867eb2
                                                                                                                                                                • Opcode Fuzzy Hash: eb7ef735fef142aa37c3edaa2482454292f0641f988a23163b716aa803a854f5
                                                                                                                                                                • Instruction Fuzzy Hash: 50515A33A2864286E760EF21E8911A96760FF4AB84F84413AEF4DC7795DF3CE5519780
                                                                                                                                                                Function 00007FF677B52DB8 Relevance: 4.7, APIs: 3, Instructions: 169COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: InfoLocale$ErrorLastValue_invalid_parameter_noinfo
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1791019856-0
                                                                                                                                                                • Opcode ID: 2edb3bf82728295180c65a49a809a5ee1e0151546429d92055b3ea941b95bd0e
                                                                                                                                                                • Instruction ID: a8f91caad287a35c7f9ae7f74de08eff9db6431c7b568f8c6fd6c7fa205eb298
                                                                                                                                                                • Opcode Fuzzy Hash: 2edb3bf82728295180c65a49a809a5ee1e0151546429d92055b3ea941b95bd0e
                                                                                                                                                                • Instruction Fuzzy Hash: 486155B3A296428AEB248F25F5402B973A1FB96F44F048135DF9ED7691DE3CE895C700
                                                                                                                                                                Function 00007FF677B4C6F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: InfoLocale
                                                                                                                                                                • String ID: GetLocaleInfoEx
                                                                                                                                                                • API String ID: 2299586839-2904428671
                                                                                                                                                                • Opcode ID: 46ad82fc76a354a1969e044b370f534e21d4f5b55515904f28d8f50243491802
                                                                                                                                                                • Instruction ID: d1fc4ff6f3c2790e2d02f08fdb7e61354617bd76395fa20c79f29e13fd6f5b2a
                                                                                                                                                                • Opcode Fuzzy Hash: 46ad82fc76a354a1969e044b370f534e21d4f5b55515904f28d8f50243491802
                                                                                                                                                                • Instruction Fuzzy Hash: E6018F32B28B8186E7048F56B4000AAA361BF8AFD0F588035DE4D93B65DF3CD9428380
                                                                                                                                                                Function 00007FF677B53004 Relevance: 1.6, APIs: 1, Instructions: 70COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLastValue$InfoLocale
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 673564084-0
                                                                                                                                                                • Opcode ID: 3cf5d53ee3289d9df318b85bb062696feed895c921995e6b8ba8a8d8c1f80ca6
                                                                                                                                                                • Instruction ID: 9b48dacb7fa8199838fa3c0d0acc7dc5a6af1507015be7a4278c7b117df59e1d
                                                                                                                                                                • Opcode Fuzzy Hash: 3cf5d53ee3289d9df318b85bb062696feed895c921995e6b8ba8a8d8c1f80ca6
                                                                                                                                                                • Instruction Fuzzy Hash: E3316F73B1878286EB648F21E5413AA63A1FB4AF88F088035DE5DC7785DE3CE4998700
                                                                                                                                                                Function 00007FF677B52C50 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00007FF677B4A764: GetLastError.KERNEL32 ref: 00007FF677B4A773
                                                                                                                                                                  • Part of subcall function 00007FF677B4A764: FlsGetValue.KERNEL32 ref: 00007FF677B4A788
                                                                                                                                                                  • Part of subcall function 00007FF677B4A764: SetLastError.KERNEL32 ref: 00007FF677B4A813
                                                                                                                                                                • EnumSystemLocalesW.KERNEL32(?,?,?,00007FF677B5343B,?,00000000,00000092,?,?,00000000,?,00007FF677B47961), ref: 00007FF677B52CEE
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLast$EnumLocalesSystemValue
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3029459697-0
                                                                                                                                                                • Opcode ID: 5c265d89f6884c981363f9f029a9b0ae3ba194294e091a085da889c90eb634f2
                                                                                                                                                                • Instruction ID: 7f39874249a3bbd6ccba2c766c57f764db8e12c3d9aab5930448c82700a19f9d
                                                                                                                                                                • Opcode Fuzzy Hash: 5c265d89f6884c981363f9f029a9b0ae3ba194294e091a085da889c90eb634f2
                                                                                                                                                                • Instruction Fuzzy Hash: 4F11DFB7E286458AEB148F16E0802F87BA0FB91FA0F448135CA29C33C1DE38D5D1C740
                                                                                                                                                                Function 00007FF677B5320C Relevance: 1.6, APIs: 1, Instructions: 50COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00007FF677B4A764: GetLastError.KERNEL32 ref: 00007FF677B4A773
                                                                                                                                                                  • Part of subcall function 00007FF677B4A764: FlsGetValue.KERNEL32 ref: 00007FF677B4A788
                                                                                                                                                                  • Part of subcall function 00007FF677B4A764: SetLastError.KERNEL32 ref: 00007FF677B4A813
                                                                                                                                                                • GetLocaleInfoW.KERNEL32(?,?,?,00007FF677B52FB5), ref: 00007FF677B53243
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLast$InfoLocaleValue
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3796814847-0
                                                                                                                                                                • Opcode ID: 10a17dd5b4641249e909435977586a111e918bdd9a964e00a6768462a78b774b
                                                                                                                                                                • Instruction ID: 8a94f97ea3dc78c4e0a16a3030264229600493bb8d48e8fdf0f948e4dcabd50b
                                                                                                                                                                • Opcode Fuzzy Hash: 10a17dd5b4641249e909435977586a111e918bdd9a964e00a6768462a78b774b
                                                                                                                                                                • Instruction Fuzzy Hash: FF11E733A2CA9682E7A49F56F04077A6261FB42F68F104135DE69877C4DE3AD8C58700
                                                                                                                                                                Function 00007FF677B52D20 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00007FF677B4A764: GetLastError.KERNEL32 ref: 00007FF677B4A773
                                                                                                                                                                  • Part of subcall function 00007FF677B4A764: FlsGetValue.KERNEL32 ref: 00007FF677B4A788
                                                                                                                                                                  • Part of subcall function 00007FF677B4A764: SetLastError.KERNEL32 ref: 00007FF677B4A813
                                                                                                                                                                • EnumSystemLocalesW.KERNEL32(?,?,?,00007FF677B533F7,?,00000000,00000092,?,?,00000000,?,00007FF677B47961), ref: 00007FF677B52D9E
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLast$EnumLocalesSystemValue
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3029459697-0
                                                                                                                                                                • Opcode ID: e0582258924b31d0dff14eb7510edeff1ade51673afc4db08da0986feca96046
                                                                                                                                                                • Instruction ID: 9e97bdd1b9e91f6b118ea8db20981e83743c4841b508b5816f7298f0cd981bed
                                                                                                                                                                • Opcode Fuzzy Hash: e0582258924b31d0dff14eb7510edeff1ade51673afc4db08da0986feca96046
                                                                                                                                                                • Instruction Fuzzy Hash: AE0128B3F2824246E7504F19F5407F976A1EB42FA4F448232DA29C72C4CF7C94C18700
                                                                                                                                                                Function 00007FF677B4C26C Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF677B4C6BF,?,?,?,?,?,?,?,?,00000000,00007FF677B5229C), ref: 00007FF677B4C2BB
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: EnumLocalesSystem
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2099609381-0
                                                                                                                                                                • Opcode ID: 2627d4586828cf42fd1e5fb6bce5a7d4f2eb2fd864c9e404babdbe420a057d9a
                                                                                                                                                                • Instruction ID: 31fb13a793a7179b9a720a72841d671cd5ca7207b617510c24639e381a3b1711
                                                                                                                                                                • Opcode Fuzzy Hash: 2627d4586828cf42fd1e5fb6bce5a7d4f2eb2fd864c9e404babdbe420a057d9a
                                                                                                                                                                • Instruction Fuzzy Hash: 63F01472B28A8182E704DF29E8906A96361EB9AF90F448136EE4DC7365DF3CD5A58340
                                                                                                                                                                Function 00007FF677B2CDC4 Relevance: 84.4, APIs: 25, Strings: 23, Instructions: 385stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00007FF677B1156C: GetProcessHeap.KERNEL32(?,?,?,00007FF677B15186,?,?,?,?,00007FF677B11009), ref: 00007FF677B115E2
                                                                                                                                                                  • Part of subcall function 00007FF677B1156C: _Init_thread_footer.LIBCMT ref: 00007FF677B11617
                                                                                                                                                                  • Part of subcall function 00007FF677B1156C: _Init_thread_footer.LIBCMT ref: 00007FF677B11680
                                                                                                                                                                • lstrcmpiW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF677B2CE4C
                                                                                                                                                                • lstrcmpiW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF677B2CE81
                                                                                                                                                                • IIDFromString.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF677B2CE92
                                                                                                                                                                • lstrcmpiW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF677B2CF05
                                                                                                                                                                • lstrcmpiW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF677B2CF2B
                                                                                                                                                                • lstrcmpiW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF677B2CF48
                                                                                                                                                                • lstrcmpiW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF677B2CF65
                                                                                                                                                                • lstrcmpiW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF677B2CF82
                                                                                                                                                                • lstrcmpiW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF677B2CFCB
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: lstrcmpi$Init_thread_footer$FromHeapProcessString
                                                                                                                                                                • String ID: appguid$appname$brand$browser$bundlename$client$devmode$experiments$false$hostprefix$iid$installargs$installdataindex$lang$needsadmin$omahaexperiments$prefers$referral$runtime$true$tttoken$untrusteddata$usagestats
                                                                                                                                                                • API String ID: 3718950843-3344293783
                                                                                                                                                                • Opcode ID: 8a3822b5e6e7bbda70f83bcb8f0711b10a5f8263fa8a73858bb723b5879b1820
                                                                                                                                                                • Instruction ID: d73f1a2071907aea1cfb56d9485982d1afac12303fc4297b9e9aee8f4bec5146
                                                                                                                                                                • Opcode Fuzzy Hash: 8a3822b5e6e7bbda70f83bcb8f0711b10a5f8263fa8a73858bb723b5879b1820
                                                                                                                                                                • Instruction Fuzzy Hash: CF023973B2974392EB24DF25E8542B923A1AF46F84F841132DE0EC6695EF3CE599D300
                                                                                                                                                                Function 00007FF677B1BD74 Relevance: 33.2, APIs: 10, Strings: 12, Instructions: 166stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: lstrcmpi
                                                                                                                                                                • String ID: HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_LOCAL_MACHINE[64]$HKEY_USERS$HKLM$HKLM[64]$HKLM\Software\AVG\Browser\Update\$HKU$devmode
                                                                                                                                                                • API String ID: 1586166983-3575672613
                                                                                                                                                                • Opcode ID: 1b73725733ed5e62d06c9bef552d3424591f2d1cfc1a7f2d295dbee38cf0a3ac
                                                                                                                                                                • Instruction ID: 29be00158aeb6ccf36abab7265aab77f79588a90efed14e136ba385ad5712896
                                                                                                                                                                • Opcode Fuzzy Hash: 1b73725733ed5e62d06c9bef552d3424591f2d1cfc1a7f2d295dbee38cf0a3ac
                                                                                                                                                                • Instruction Fuzzy Hash: 38614C77A28B4681EA149F26E84027A6361BF47FA0F584235DE5DCA7E4EF7CE584C700
                                                                                                                                                                Function 00007FF677B16F50 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 198filestringsynchronizationCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$Write$CreateDebugDescriptorMutexOutputPointerReleaseSecurityStringlstrlen$CloseControlErrorHandleLastOwnerwvsprintf
                                                                                                                                                                • String ID: LOG_SYSTEM: [%s]: Could not acquire logging mutex %s$LOG_SYSTEM: [%s]: Could not create logging file %s
                                                                                                                                                                • API String ID: 2301240503-2023621912
                                                                                                                                                                • Opcode ID: 57670b416e660c2e2fe659da167fdc924cc2eab26e04bbe6bcb5f2f6cbc490ef
                                                                                                                                                                • Instruction ID: 234cc965e349e86beaae40650e6d9dd5376f9d0e270f0c1fb355b788f4cbc439
                                                                                                                                                                • Opcode Fuzzy Hash: 57670b416e660c2e2fe659da167fdc924cc2eab26e04bbe6bcb5f2f6cbc490ef
                                                                                                                                                                • Instruction Fuzzy Hash: 6F917E73A24A8296EB24CF35E9445793761FB46FA8B008231DF1D83A94CF3CE9A5C740
                                                                                                                                                                Function 00007FF677B14F98 Relevance: 26.4, APIs: 4, Strings: 11, Instructions: 120timethreadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Current$LocalProcessThreadTime_cwprintf_s_l
                                                                                                                                                                • String ID: DEBUG$ERROR$FATAL$INFO$TRACE$UNKNOWN$WARN$[%02d/%02d/%02d %02d:%02d:%02d.%03d]$[%s:%s]$[%s:%u]$[%s][%u:%u]
                                                                                                                                                                • API String ID: 2343420834-6209373
                                                                                                                                                                • Opcode ID: 17c09145e531f6cba5f9d6cb854362c4e04aedf988e8793f11aff6aff6012224
                                                                                                                                                                • Instruction ID: 49dbdbeb656e8dcdfcafa84c164eef301d0885515a66ddc6e9174d03db0b3d30
                                                                                                                                                                • Opcode Fuzzy Hash: 17c09145e531f6cba5f9d6cb854362c4e04aedf988e8793f11aff6aff6012224
                                                                                                                                                                • Instruction Fuzzy Hash: 08519533A2C64681E6548F99A8845B9A760FF47F50F410132EE9DD36E4EF7CE949C740
                                                                                                                                                                Function 00007FF677B1673C Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 243synchronizationCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: DescriptorSecurity$ControlDaclGroupOwnerSacl$CreateErrorLastMutex
                                                                                                                                                                • String ID: _AVG_Update_logging_mutex_
                                                                                                                                                                • API String ID: 495249308-2711334122
                                                                                                                                                                • Opcode ID: 389f17bf63e7e89aff1dd742421f0ea55a8eeb56c305c8df6d452d2bbb93bda1
                                                                                                                                                                • Instruction ID: dace10871746ec637e909370c5b797a64623df07c01d2c5ac984554dd5e56a8b
                                                                                                                                                                • Opcode Fuzzy Hash: 389f17bf63e7e89aff1dd742421f0ea55a8eeb56c305c8df6d452d2bbb93bda1
                                                                                                                                                                • Instruction Fuzzy Hash: CBB15773B29A469AEB00DFB5D4501EC23B1EB86F9CB444532DE1D97A98DF38E549C380
                                                                                                                                                                Function 00007FF677B1AE4C Relevance: 21.3, APIs: 4, Strings: 8, Instructions: 326registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: lstrcmpi$Close$CreateValue
                                                                                                                                                                • String ID: [Failed to create reg key: %s]$[Wrote binary value: %s:%s, len = %d]$[Wrote expandable string value: %s:%s = %s]$[Wrote int32 value: %s:%s = %d]$[Wrote int64 value: %s:%s = %s]$[Wrote multi-sz value: %s:%s, len = %d]$[Wrote string value: %s:%s = %s]$base\reg_key.cc
                                                                                                                                                                • API String ID: 2977736647-2563664444
                                                                                                                                                                • Opcode ID: fa3d53b7317bde61eb6a55e305798130e840eb9c29678217f360499b1f998628
                                                                                                                                                                • Instruction ID: f782bcc1a00264877df24eadadbacd609059616f965c9c42d9c7045e8d7c0212
                                                                                                                                                                • Opcode Fuzzy Hash: fa3d53b7317bde61eb6a55e305798130e840eb9c29678217f360499b1f998628
                                                                                                                                                                • Instruction Fuzzy Hash: EDE18C73B28A428AEB11CFA5D4502AD37B6AB47B88F404136DE1D97B98EF7CD519C340
                                                                                                                                                                Function 00007FF677B31404 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
                                                                                                                                                                • String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                                                                                                                                • API String ID: 2565136772-3242537097
                                                                                                                                                                • Opcode ID: 457dee24593fad1cfb92c620a92ec9b9cf16fd18e9158cffdcffe67c7d65ecc1
                                                                                                                                                                • Instruction ID: d9bdc08aefcf3e5ae8c1e5a5d8fb841e8945eaac693a839cb9717564f9f20a05
                                                                                                                                                                • Opcode Fuzzy Hash: 457dee24593fad1cfb92c620a92ec9b9cf16fd18e9158cffdcffe67c7d65ecc1
                                                                                                                                                                • Instruction Fuzzy Hash: AC210733A3AA0692FA549F61F99457563A5EF8BF41F440835CD0E866A5EF3CA4D88700
                                                                                                                                                                Function 00007FF677B40358 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 417COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                                                                • String ID: 0$0$0$0
                                                                                                                                                                • API String ID: 3215553584-3558443385
                                                                                                                                                                • Opcode ID: 268f25bc4e91948421b43e57df936841d493638fd22a6e37a65f3fee7bb7ef9a
                                                                                                                                                                • Instruction ID: f4ad69b9817d78b645edcdbdaaf66c32bd31dac8e66f345f54ce47251b50727a
                                                                                                                                                                • Opcode Fuzzy Hash: 268f25bc4e91948421b43e57df936841d493638fd22a6e37a65f3fee7bb7ef9a
                                                                                                                                                                • Instruction Fuzzy Hash: B1F1B133A2DA968AF7618F2585902BD3BA5EB57F80F448071CF8DC7782CE3CA455A701
                                                                                                                                                                Function 00007FF677B29B00 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 119processsynchronizationwindowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ByteCharCloseHandleMultiWide$CreateFileMessageModuleNameObjectProcessSingleWait
                                                                                                                                                                • String ID: DebugMessage.exe$Fatal error
                                                                                                                                                                • API String ID: 1339838061-790405340
                                                                                                                                                                • Opcode ID: 83dee73d61ffc586e35e20dc6976c2571331de264ec5c65710d30efa9a3667de
                                                                                                                                                                • Instruction ID: fb435b88576c2d7539966c5ab34296f67a44ff304abee1224cdaf180d0764a02
                                                                                                                                                                • Opcode Fuzzy Hash: 83dee73d61ffc586e35e20dc6976c2571331de264ec5c65710d30efa9a3667de
                                                                                                                                                                • Instruction Fuzzy Hash: 91518F33A28A8186EB10DF61E8505BA77A5FB8AB94F440135DE5D93BA8DF3CD185CB40
                                                                                                                                                                Function 00007FF677B363BC Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 312COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Frame$BlockEstablisherHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                • String ID: csm$csm$csm
                                                                                                                                                                • API String ID: 3606184308-393685449
                                                                                                                                                                • Opcode ID: 198dba17e256b74fce512cc8d95954de6de39927d0e555083088ea5eca474ec1
                                                                                                                                                                • Instruction ID: 90154a6df7c9f308b3bc0c67f5da09374c4a8a49f10f8e71fc13d1ffdb22b05e
                                                                                                                                                                • Opcode Fuzzy Hash: 198dba17e256b74fce512cc8d95954de6de39927d0e555083088ea5eca474ec1
                                                                                                                                                                • Instruction Fuzzy Hash: BDD16D73A187418AEB208F7594842AD3BA0FB4AB9CF110136EE8D97B59DF38E095C700
                                                                                                                                                                Function 00007FF677B1DC20 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 87COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Lockitstd::_$Lockit::_Lockit::~_$std::ios_base::failure::failure
                                                                                                                                                                • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                                                                                                                                                • API String ID: 3570791469-1866435925
                                                                                                                                                                • Opcode ID: c5afc01824cb36fd16d4f86ccd599594f093ce27e51f921a9bfefc5da3172a14
                                                                                                                                                                • Instruction ID: 836ce47cb7a793478c101f5933f9c4ad06a2df078d92cba4dd9903479950d5e5
                                                                                                                                                                • Opcode Fuzzy Hash: c5afc01824cb36fd16d4f86ccd599594f093ce27e51f921a9bfefc5da3172a14
                                                                                                                                                                • Instruction Fuzzy Hash: C831BC73A39A4295EE15DF19D4406B86370EF82F88F940432DE4C87AA5DF2CE992C740
                                                                                                                                                                Function 00007FF677B3E5B8 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 489COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                                                                • String ID: 0$f$p$p
                                                                                                                                                                • API String ID: 3215553584-1202675169
                                                                                                                                                                • Opcode ID: 5f915feb5ea7b08020898feac31b06170b382d8d87292810405de98b8ff23c05
                                                                                                                                                                • Instruction ID: 430b11659c5b3cc2670f68862934ca9140713e32190f0c93c23f4e5dff050c7e
                                                                                                                                                                • Opcode Fuzzy Hash: 5f915feb5ea7b08020898feac31b06170b382d8d87292810405de98b8ff23c05
                                                                                                                                                                • Instruction Fuzzy Hash: D6126E33A2C24387FB645FA5E04467A6691FB82F54F884137EE9A866C4DF3DE5C08B40
                                                                                                                                                                Function 00007FF677B16D48 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 130registrystringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: QueryValue$Openlstrcmplstrlen
                                                                                                                                                                • String ID: PendingFileRenameOperations$\??\
                                                                                                                                                                • API String ID: 2090349685-1186864550
                                                                                                                                                                • Opcode ID: dcfc55eaf4ecb9f3f0a74e7da5979d770500bfd5a0fcf182a2163079e3f56080
                                                                                                                                                                • Instruction ID: 78b63977bdc2d0960930891b30e5f99d5eb2fd6bc494107576e08c4f91d0ffb1
                                                                                                                                                                • Opcode Fuzzy Hash: dcfc55eaf4ecb9f3f0a74e7da5979d770500bfd5a0fcf182a2163079e3f56080
                                                                                                                                                                • Instruction Fuzzy Hash: 9C515F33A28A4286FB108F65E4056A973B4FF4AB5CF455231DE4C97664EF38E685C380
                                                                                                                                                                Function 00007FF677B3A150 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 475COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                                                                • String ID: f$p$p
                                                                                                                                                                • API String ID: 3215553584-1995029353
                                                                                                                                                                • Opcode ID: fa0c5140ee98f8df3daf45bb31bbfcb53f9c8339155fd0f9468207752f1acb10
                                                                                                                                                                • Instruction ID: 4e2e82e8a251494207400bccad3c2e9023febca7fc76a6786b89237422eb7e0a
                                                                                                                                                                • Opcode Fuzzy Hash: fa0c5140ee98f8df3daf45bb31bbfcb53f9c8339155fd0f9468207752f1acb10
                                                                                                                                                                • Instruction Fuzzy Hash: C6128133E2C14387FB249F25E0486BA7662EB92F54FA44135FA99866C4DF3DE4C58B10
                                                                                                                                                                Function 00007FF677B21288 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 127COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$GetctypeGetwctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
                                                                                                                                                                • String ID: bad locale name
                                                                                                                                                                • API String ID: 1386471777-1405518554
                                                                                                                                                                • Opcode ID: 4debd969461134cc0d9fcce3c82ed7fd0acd57d95e36162bf1145feb5112141f
                                                                                                                                                                • Instruction ID: 251fb5304e41d5b24dbe31e87b276113c3be3dc65d2119c930a2c37df56cf249
                                                                                                                                                                • Opcode Fuzzy Hash: 4debd969461134cc0d9fcce3c82ed7fd0acd57d95e36162bf1145feb5112141f
                                                                                                                                                                • Instruction Fuzzy Hash: 87517633F29B858AEB14DFB094401AC33B5EB96B88B044535DE8DA7A56DF38E5968340
                                                                                                                                                                Function 00007FF677B38ADC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LoadLibraryExW.KERNEL32(?,?,?,00007FF677B38D8E,?,?,?,00007FF677B35A3C,?,?,?,?,00007FF677B34801), ref: 00007FF677B38B61
                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,00007FF677B38D8E,?,?,?,00007FF677B35A3C,?,?,?,?,00007FF677B34801), ref: 00007FF677B38B6F
                                                                                                                                                                • LoadLibraryExW.KERNEL32(?,?,?,00007FF677B38D8E,?,?,?,00007FF677B35A3C,?,?,?,?,00007FF677B34801), ref: 00007FF677B38B99
                                                                                                                                                                • FreeLibrary.KERNEL32(?,?,?,00007FF677B38D8E,?,?,?,00007FF677B35A3C,?,?,?,?,00007FF677B34801), ref: 00007FF677B38BDF
                                                                                                                                                                • GetProcAddress.KERNEL32(?,?,?,00007FF677B38D8E,?,?,?,00007FF677B35A3C,?,?,?,?,00007FF677B34801), ref: 00007FF677B38BEB
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                • String ID: api-ms-
                                                                                                                                                                • API String ID: 2559590344-2084034818
                                                                                                                                                                • Opcode ID: dc81c7fd22c81811e9e1b6f035153abbd42ddc86383a37671ebf580e381b2a16
                                                                                                                                                                • Instruction ID: 654c23a67b3d7da27e4447e37ccd160b28f149ce2febe63c71b68573d8bd7436
                                                                                                                                                                • Opcode Fuzzy Hash: dc81c7fd22c81811e9e1b6f035153abbd42ddc86383a37671ebf580e381b2a16
                                                                                                                                                                • Instruction Fuzzy Hash: 8E319E73A3AB4292EE12DF26A8405756394FF4AFA0F590535ED1D8B394EF3CE4808321
                                                                                                                                                                Function 00007FF677B19E40 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 64windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExitMessageProcesswsprintf
                                                                                                                                                                • String ID: Exception$Exception %x in %s %s %u%hs:%d$base\logging.cc
                                                                                                                                                                • API String ID: 1070390611-1730742759
                                                                                                                                                                • Opcode ID: a445fa34e2534bcc17140918e08a8dc4d49864915a11fa4788c51bcb6cd5f040
                                                                                                                                                                • Instruction ID: 892a95ff020a67238dfd3a1b14c0c334c0a146c71991e816121f224e13944226
                                                                                                                                                                • Opcode Fuzzy Hash: a445fa34e2534bcc17140918e08a8dc4d49864915a11fa4788c51bcb6cd5f040
                                                                                                                                                                • Instruction Fuzzy Hash: 5A31A433A28A8582E7108F24E84027A73A0FB86BA4F544636EE5DC3698DF7CD545CB80
                                                                                                                                                                Function 00007FF677B4A764 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Value$ErrorLast
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2506987500-0
                                                                                                                                                                • Opcode ID: 27590d12e9e39d6fb1356392d5999d30c05359e5ae574aae1b947bc399adaaf6
                                                                                                                                                                • Instruction ID: cc76702eeb3164e8d12416c653f7784d297456eb0197708957a6de252a9a6b5c
                                                                                                                                                                • Opcode Fuzzy Hash: 27590d12e9e39d6fb1356392d5999d30c05359e5ae574aae1b947bc399adaaf6
                                                                                                                                                                • Instruction Fuzzy Hash: 77218133E2D24252FA646F3195590396352AF4AFB4F144735ED3EC7BD6EE2CB441A240
                                                                                                                                                                Function 00007FF677B59C00 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                • String ID: CONOUT$
                                                                                                                                                                • API String ID: 3230265001-3130406586
                                                                                                                                                                • Opcode ID: 7b1ff874d1af353d49a0b7100ec053535788ac338d30382d1d2537f328b36db4
                                                                                                                                                                • Instruction ID: 60f183d8a2b647faa556c380bf4d8c28dcd098cfb402a8e316d577e2ea2d798a
                                                                                                                                                                • Opcode Fuzzy Hash: 7b1ff874d1af353d49a0b7100ec053535788ac338d30382d1d2537f328b36db4
                                                                                                                                                                • Instruction Fuzzy Hash: 4A114C32A28A8186E7508F62F85432A66A1FB8AFE4F044235EE5DC7794DF3CD5848741
                                                                                                                                                                Function 00007FF677B33710 Relevance: 9.2, APIs: 6, Instructions: 203COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ByteCharMultiStringWide
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2829165498-0
                                                                                                                                                                • Opcode ID: 2d16fb6eb56c47bece98c290ede99a390be05abe9993bf8f9e3a74cb7cc736e0
                                                                                                                                                                • Instruction ID: 87924835ee336a8db9df66cf96de103cf63098efcfdb0aa0bd604d30a1923cde
                                                                                                                                                                • Opcode Fuzzy Hash: 2d16fb6eb56c47bece98c290ede99a390be05abe9993bf8f9e3a74cb7cc736e0
                                                                                                                                                                • Instruction Fuzzy Hash: 5E813C33A2878187EB208F61D45477A66A1FB46FA4F140635EE5E97BC8DF7CD4898700
                                                                                                                                                                Function 00007FF677B14094 Relevance: 9.1, APIs: 6, Instructions: 117COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Init_thread_footerLength$AuthorityCopyHeapInitializeProcessRequiredValid
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 910760405-0
                                                                                                                                                                • Opcode ID: b52e982fa7ca654a87e4f81344dc1c3b34df394855e755ebf26f9e498bc2c95e
                                                                                                                                                                • Instruction ID: d759523645cc84fd8bf986798bea6e62a6924e721448d9c9deb632bcabb7d90a
                                                                                                                                                                • Opcode Fuzzy Hash: b52e982fa7ca654a87e4f81344dc1c3b34df394855e755ebf26f9e498bc2c95e
                                                                                                                                                                • Instruction Fuzzy Hash: 49419D33A28B8682EA249F29E41476D67A0FF86F44F844534DE9D87791EF3CE459C740
                                                                                                                                                                Function 00007FF677B36884 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 317COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
                                                                                                                                                                • String ID: csm$csm$csm
                                                                                                                                                                • API String ID: 3523768491-393685449
                                                                                                                                                                • Opcode ID: b8837f54411783fa001437538887d7de75d76f04d05b54cc91b9e79aa49b82dd
                                                                                                                                                                • Instruction ID: 4fdf3c366c40acf007c7c7cd08e342cfc0b70658cf231df6f3485da516f8812f
                                                                                                                                                                • Opcode Fuzzy Hash: b8837f54411783fa001437538887d7de75d76f04d05b54cc91b9e79aa49b82dd
                                                                                                                                                                • Instruction Fuzzy Hash: ADE19E73A286828BE7509F74D4842AD3BA0FB4AB4CF154235EE9D87696DF38E5C5C700
                                                                                                                                                                Function 00007FF677B15F54 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 188COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID: LOG_SYSTEM: Couldn't acquire lock -
                                                                                                                                                                • API String ID: 0-1219263422
                                                                                                                                                                • Opcode ID: 086261fdc86039be9433a8607d6739e79c67abdf4b8b92de9afdab0cef868e20
                                                                                                                                                                • Instruction ID: 3ab6bea03ef9adcbf5742f9368794b007110eb3d0c4e451341ba2a71d554e0ae
                                                                                                                                                                • Opcode Fuzzy Hash: 086261fdc86039be9433a8607d6739e79c67abdf4b8b92de9afdab0cef868e20
                                                                                                                                                                • Instruction Fuzzy Hash: 13715E33A28B8182EB24DF19E84466D73A5FB89FA8F104236EE5D83B95DF38D445C740
                                                                                                                                                                Function 00007FF677B180CC Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 123COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetEnvironmentVariableW.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF677B15229,?,?,?,?,00007FF677B11009), ref: 00007FF677B18174
                                                                                                                                                                • GetEnvironmentVariableW.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF677B15229,?,?,?,?,00007FF677B11009), ref: 00007FF677B181AA
                                                                                                                                                                  • Part of subcall function 00007FF677B13FC8: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF677B13A30,base\utils.cc,?,00000028,00007FF677B12654), ref: 00007FF677B13FCE
                                                                                                                                                                  • Part of subcall function 00007FF677B13FC8: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,00007FF677B13A30,base\utils.cc,?,00000028,00007FF677B12654), ref: 00007FF677B14007
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: EnvironmentVariable$ErrorExceptionLastRaise
                                                                                                                                                                • String ID: GetEnvironmentVariable failed][%s][%#x]$GetEnvironmentVariableAsString][%s]$base\utils.cc
                                                                                                                                                                • API String ID: 3952186151-74384840
                                                                                                                                                                • Opcode ID: d6d3e89b395e225b2fc00b24b2eb69f8d264bc8a88a7402b42427eeddbd11e59
                                                                                                                                                                • Instruction ID: 47690f45cd0a751ee669a99cc7f969831a052c682a90a1c72dc437226793099e
                                                                                                                                                                • Opcode Fuzzy Hash: d6d3e89b395e225b2fc00b24b2eb69f8d264bc8a88a7402b42427eeddbd11e59
                                                                                                                                                                • Instruction Fuzzy Hash: C941A973B28A468AEB00CF66E8501AD27A1BB8AF88F504535DE0DD3B58CF3CE4118781
                                                                                                                                                                Function 00007FF677B160F4 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110sleepCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • Sleep.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF677B11889), ref: 00007FF677B1619C
                                                                                                                                                                • OutputDebugStringA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF677B11889), ref: 00007FF677B161B0
                                                                                                                                                                • OutputDebugStringW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF677B11889), ref: 00007FF677B161B9
                                                                                                                                                                • OutputDebugStringW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF677B11889), ref: 00007FF677B161C6
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: DebugOutputString$Sleep
                                                                                                                                                                • String ID: LOG_SYSTEM: Couldn't acquire lock -
                                                                                                                                                                • API String ID: 3789842296-1219263422
                                                                                                                                                                • Opcode ID: a48aa3f865f772b00b2a898472ca45dee5dfbaf36e3f28add0be01756e711828
                                                                                                                                                                • Instruction ID: a78ef2e9bb6d522f106087592eeac679720b6c107c3e64fdd573d45c275eec12
                                                                                                                                                                • Opcode Fuzzy Hash: a48aa3f865f772b00b2a898472ca45dee5dfbaf36e3f28add0be01756e711828
                                                                                                                                                                • Instruction Fuzzy Hash: 95417F37A19B8582DB649F1AE84422D73A5FB8AFA4F004235DEAD83B95DF3CD485C740
                                                                                                                                                                Function 00007FF677B1C73C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$GetctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
                                                                                                                                                                • String ID: bad locale name
                                                                                                                                                                • API String ID: 2967684691-1405518554
                                                                                                                                                                • Opcode ID: 2e32569aa7086d4e32ba4bfcd0bdf3963d8c3b7b252880c6267807437d6d33a5
                                                                                                                                                                • Instruction ID: 96017e4368770cb5804a4a0ac9ac25832a1c3c484029e53c2ccc8bd1d60e6fa1
                                                                                                                                                                • Opcode Fuzzy Hash: 2e32569aa7086d4e32ba4bfcd0bdf3963d8c3b7b252880c6267807437d6d33a5
                                                                                                                                                                • Instruction Fuzzy Hash: CD512737B29B819AEB14DFB0D0941BC33B4EF46B88B044535DE4EA7A56DF38E5658310
                                                                                                                                                                Function 00007FF677B164F4 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 103COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00007FF677B1156C: GetProcessHeap.KERNEL32(?,?,?,00007FF677B15186,?,?,?,?,00007FF677B11009), ref: 00007FF677B115E2
                                                                                                                                                                  • Part of subcall function 00007FF677B1156C: _Init_thread_footer.LIBCMT ref: 00007FF677B11617
                                                                                                                                                                  • Part of subcall function 00007FF677B1156C: _Init_thread_footer.LIBCMT ref: 00007FF677B11680
                                                                                                                                                                • GetPrivateProfileIntW.KERNEL32 ref: 00007FF677B165CD
                                                                                                                                                                • GetPrivateProfileIntW.KERNEL32 ref: 00007FF677B165EA
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Init_thread_footerPrivateProfile$HeapProcess
                                                                                                                                                                • String ID: LogFileWide$LoggingSettings$MaxLogFileSize
                                                                                                                                                                • API String ID: 2570437202-2181087832
                                                                                                                                                                • Opcode ID: 9402fe9953b55abb6a1a308c3e78c6b7e2c4cae44c8c129e23de2ce885161037
                                                                                                                                                                • Instruction ID: 3ebf971e3a7ba737e4e49f99feb0781ea99389de0f2415bd0bcf7c7534ae9663
                                                                                                                                                                • Opcode Fuzzy Hash: 9402fe9953b55abb6a1a308c3e78c6b7e2c4cae44c8c129e23de2ce885161037
                                                                                                                                                                • Instruction Fuzzy Hash: BF417E33A28B4592EB049F29E5442A827A0FF8AF98F588435DF4D83B95EF3CD595C740
                                                                                                                                                                Function 00007FF677B19F54 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 55registrylibraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressGuidsHandleModuleProcRegisterTrace
                                                                                                                                                                • String ID: RtlCaptureStackBackTrace$kernel32.dll
                                                                                                                                                                • API String ID: 3926896046-94782561
                                                                                                                                                                • Opcode ID: a189e90c182dfc53fa42db306da16c76025fb1c2835eb2ff12393544d82454a9
                                                                                                                                                                • Instruction ID: 51af308a119c1b3ace8073531c4aeae11f02a2ec95af54932b0df5e3573480cc
                                                                                                                                                                • Opcode Fuzzy Hash: a189e90c182dfc53fa42db306da16c76025fb1c2835eb2ff12393544d82454a9
                                                                                                                                                                • Instruction Fuzzy Hash: FA31E733A28B4695EB018F11E5443AA73A4FB4AB94F544135DB8C87B64EF7CE2A9C740
                                                                                                                                                                Function 00007FF677B16CA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 44COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • OutputDebugStringW.KERNEL32(?,?,?,00007FF677B16B39), ref: 00007FF677B16CB9
                                                                                                                                                                  • Part of subcall function 00007FF677B19AF0: MoveFileExW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF677B16CE7,?,?,?,00007FF677B16B39), ref: 00007FF677B19B0B
                                                                                                                                                                • OutputDebugStringW.KERNEL32(?,?,?,00007FF677B16B39), ref: 00007FF677B16CF2
                                                                                                                                                                  • Part of subcall function 00007FF677B16D48: RegOpenKeyExW.ADVAPI32 ref: 00007FF677B16DE8
                                                                                                                                                                  • Part of subcall function 00007FF677B16D48: RegQueryValueExW.ADVAPI32 ref: 00007FF677B16E21
                                                                                                                                                                  • Part of subcall function 00007FF677B16D48: RegQueryValueExW.ADVAPI32 ref: 00007FF677B16E71
                                                                                                                                                                  • Part of subcall function 00007FF677B16D48: lstrcmpW.KERNEL32 ref: 00007FF677B16ECF
                                                                                                                                                                  • Part of subcall function 00007FF677B16D48: lstrlenW.KERNEL32 ref: 00007FF677B16EDC
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: DebugOutputQueryStringValue$FileMoveOpenlstrcmplstrlen
                                                                                                                                                                • String ID: .bak$LOG_SYSTEM: failed to move log file to backup$LOG_SYSTEM: trying to move log file to backup
                                                                                                                                                                • API String ID: 691347042-3505153176
                                                                                                                                                                • Opcode ID: 872ed5db961bc4c3df8ec324e1a388f1382baee1d0533ed8aff8b32cf865c29c
                                                                                                                                                                • Instruction ID: 0c63a4282b98ad46e78c7dba70321a15221c2ade990c561998d2c38ac85db5b4
                                                                                                                                                                • Opcode Fuzzy Hash: 872ed5db961bc4c3df8ec324e1a388f1382baee1d0533ed8aff8b32cf865c29c
                                                                                                                                                                • Instruction Fuzzy Hash: 53119E77A28A8282EA109F21E4410B96320FF8AFD8B544132EF6EC7795DF2CD655C740
                                                                                                                                                                Function 00007FF677B46FA8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                • API String ID: 4061214504-1276376045
                                                                                                                                                                • Opcode ID: f66967364f7d47dcf7b345cbaeb4faf0d162dc5b5b7c74fcb5a165cce6619801
                                                                                                                                                                • Instruction ID: 24acf1436149c8031f96d135a66c1c4d3357a4516e60fc315b1f36f623118afd
                                                                                                                                                                • Opcode Fuzzy Hash: f66967364f7d47dcf7b345cbaeb4faf0d162dc5b5b7c74fcb5a165cce6619801
                                                                                                                                                                • Instruction Fuzzy Hash: 79F0A932A39A0681EA148F20F85873A6320EF8BB64F480235DE6EC52E4DF3CD484C340
                                                                                                                                                                Function 00007FF677B35C8C Relevance: 7.8, APIs: 5, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AdjustPointer
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1740715915-0
                                                                                                                                                                • Opcode ID: d1315b849427110afe350d66afec4806d99e273ac048d2496bd35b050366b387
                                                                                                                                                                • Instruction ID: d2472d80bad609b98e5750a0146cb0e6b97b329fc56490414c1bf2a05f32a542
                                                                                                                                                                • Opcode Fuzzy Hash: d1315b849427110afe350d66afec4806d99e273ac048d2496bd35b050366b387
                                                                                                                                                                • Instruction Fuzzy Hash: 4EB19F33B2A65283EA659F31D4C46396A94EF46F88F098536DE4D8B795DF3CE4C18300
                                                                                                                                                                Function 00007FF677B2C85C Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 209stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: lstrcmpi
                                                                                                                                                                • String ID: appguid$installerdata
                                                                                                                                                                • API String ID: 1586166983-1661278696
                                                                                                                                                                • Opcode ID: a56ef32f860d9b4de302c9e3876d68659533d3c69e8ea90c5d8ad641fb0d2999
                                                                                                                                                                • Instruction ID: b508e05d9a189263a363808f7808543161f61162763a1d7ad19631e142226cd8
                                                                                                                                                                • Opcode Fuzzy Hash: a56ef32f860d9b4de302c9e3876d68659533d3c69e8ea90c5d8ad641fb0d2999
                                                                                                                                                                • Instruction Fuzzy Hash: 9681AE73B16B4682EB14DF29D84026963A0FB86FA4B144636DE6D877E4DF3CE491C740
                                                                                                                                                                Function 00007FF677B4DEEC Relevance: 7.7, APIs: 5, Instructions: 196COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _set_statfp
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1156100317-0
                                                                                                                                                                • Opcode ID: e825891b63011534a31cc7101a55108f87b3ba01cc3cb9b25d96b9fdfe69b75c
                                                                                                                                                                • Instruction ID: 472a0ef31e2b0fea33334123b32d34b6b64562f3fa72c79010e2c8b42ba2a98e
                                                                                                                                                                • Opcode Fuzzy Hash: e825891b63011534a31cc7101a55108f87b3ba01cc3cb9b25d96b9fdfe69b75c
                                                                                                                                                                • Instruction Fuzzy Hash: AD81E133D28A8645F6328F74A4503BAA7A0BF47B94F044331EE5EA66D5DF3CA581A600
                                                                                                                                                                Function 00007FF677B40998 Relevance: 7.7, APIs: 5, Instructions: 157COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3215553584-0
                                                                                                                                                                • Opcode ID: bba29f14b1b2009a506413327334f38ed1e8ba65f5a301e31d8d16c34f328480
                                                                                                                                                                • Instruction ID: 08d4e3247a637517221ddf048990e58b667aa23b6d34da599141dd612f6c582b
                                                                                                                                                                • Opcode Fuzzy Hash: bba29f14b1b2009a506413327334f38ed1e8ba65f5a301e31d8d16c34f328480
                                                                                                                                                                • Instruction Fuzzy Hash: 71517233929B8686E7629F3594603BD3BD0AB13F48F4990B1DE8C87386CE3DA445D316
                                                                                                                                                                Function 00007FF677B16AE8 Relevance: 7.6, APIs: 5, Instructions: 104fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00007FF677B19CE0: GetFileAttributesExW.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF677B16B28), ref: 00007FF677B19D19
                                                                                                                                                                • CreateFileW.KERNEL32 ref: 00007FF677B16B67
                                                                                                                                                                  • Part of subcall function 00007FF677B16CA0: OutputDebugStringW.KERNEL32(?,?,?,00007FF677B16B39), ref: 00007FF677B16CB9
                                                                                                                                                                  • Part of subcall function 00007FF677B16CA0: OutputDebugStringW.KERNEL32(?,?,?,00007FF677B16B39), ref: 00007FF677B16CF2
                                                                                                                                                                  • Part of subcall function 00007FF677B14094: GetSidLengthRequired.ADVAPI32 ref: 00007FF677B1415F
                                                                                                                                                                  • Part of subcall function 00007FF677B14094: InitializeSid.ADVAPI32 ref: 00007FF677B1417E
                                                                                                                                                                  • Part of subcall function 00007FF677B14094: GetSidSubAuthority.ADVAPI32 ref: 00007FF677B141B2
                                                                                                                                                                  • Part of subcall function 00007FF677B14094: IsValidSid.ADVAPI32 ref: 00007FF677B141CD
                                                                                                                                                                  • Part of subcall function 00007FF677B14094: GetLengthSid.ADVAPI32 ref: 00007FF677B141DC
                                                                                                                                                                  • Part of subcall function 00007FF677B14094: CopySid.ADVAPI32 ref: 00007FF677B141F6
                                                                                                                                                                  • Part of subcall function 00007FF677B145B4: IsValidSid.ADVAPI32 ref: 00007FF677B145DF
                                                                                                                                                                • SetNamedSecurityInfoW.ADVAPI32 ref: 00007FF677B16C27
                                                                                                                                                                • SetLastError.KERNEL32 ref: 00007FF677B16C2F
                                                                                                                                                                • GetLastError.KERNEL32 ref: 00007FF677B16C35
                                                                                                                                                                • WriteFile.KERNEL32 ref: 00007FF677B16C67
                                                                                                                                                                  • Part of subcall function 00007FF677B14338: InitializeAcl.ADVAPI32 ref: 00007FF677B143BE
                                                                                                                                                                  • Part of subcall function 00007FF677B14338: AddAce.ADVAPI32 ref: 00007FF677B14414
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$DebugErrorInitializeLastLengthOutputStringValid$AttributesAuthorityCopyCreateInfoNamedRequiredSecurityWrite
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1824262441-0
                                                                                                                                                                • Opcode ID: e52f17b0339b4653b2501d2a5ec4088ca2fad63fd02e529494250d5d8247590f
                                                                                                                                                                • Instruction ID: 93830bd42e28beb739183c3dc9c85c59fb6e00768ad2df7b37af2706320bfd67
                                                                                                                                                                • Opcode Fuzzy Hash: e52f17b0339b4653b2501d2a5ec4088ca2fad63fd02e529494250d5d8247590f
                                                                                                                                                                • Instruction Fuzzy Hash: 7E419133A28A9196E720CF21E4406AA77A4F78AB94F500235EF9C83B54DF3CD555CB00
                                                                                                                                                                Function 00007FF677B1FD08 Relevance: 7.6, APIs: 5, Instructions: 73COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 459529453-0
                                                                                                                                                                • Opcode ID: 4e415d717791d56eb245b0dade4d273719645c6fdba47c45f74f0abd09231a8f
                                                                                                                                                                • Instruction ID: f1d75f02cb788cc64b1b1127a56ce43234e2042537766e0d466a723db423f9c3
                                                                                                                                                                • Opcode Fuzzy Hash: 4e415d717791d56eb245b0dade4d273719645c6fdba47c45f74f0abd09231a8f
                                                                                                                                                                • Instruction Fuzzy Hash: F4316137A2AA4285EB159F69D4400F86360EF56FA8F184132DF5DC76A5DF2CF482C300
                                                                                                                                                                Function 00007FF677B1DC94 Relevance: 7.6, APIs: 5, Instructions: 73COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeLocinfo::_Locinfo_ctorRegister
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2236780835-0
                                                                                                                                                                • Opcode ID: ece061961cce685f6f508fc768c54023b3996b1e5df6d8958903e22d33d29f2a
                                                                                                                                                                • Instruction ID: e4bee6ac6eae674721c4162f91ba1d54172638ae873dd585105f6ff832b31da2
                                                                                                                                                                • Opcode Fuzzy Hash: ece061961cce685f6f508fc768c54023b3996b1e5df6d8958903e22d33d29f2a
                                                                                                                                                                • Instruction Fuzzy Hash: 6931AE73A29A4295EF15DF29E4401B8A370EF86FA8F580632DE5D876A5DF3CE491C300
                                                                                                                                                                Function 00007FF677B1FC04 Relevance: 7.6, APIs: 5, Instructions: 73COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 459529453-0
                                                                                                                                                                • Opcode ID: a5049c2ecaa0c7122ebe01cb03962b7fcd0da58844970e868d38a7a833506163
                                                                                                                                                                • Instruction ID: 5ef9897605777e418e45d843fbeb350342e50e1518b258643ac0b2cb3ce1d5f2
                                                                                                                                                                • Opcode Fuzzy Hash: a5049c2ecaa0c7122ebe01cb03962b7fcd0da58844970e868d38a7a833506163
                                                                                                                                                                • Instruction Fuzzy Hash: 4E316F37A2AA4285EB159F29E4400B9A760FF5AF98F184632DF5D877A5DF2CF445C300
                                                                                                                                                                Function 00007FF677B282E4 Relevance: 7.6, APIs: 5, Instructions: 73COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 459529453-0
                                                                                                                                                                • Opcode ID: c202e21665d66cf3847ad632200f547c670d76f3bb278239d3f485d6bc48eb5e
                                                                                                                                                                • Instruction ID: 091945ace71d4c10bae15be8aeab4cc9b345faadce82c534eb73a81cfc6df114
                                                                                                                                                                • Opcode Fuzzy Hash: c202e21665d66cf3847ad632200f547c670d76f3bb278239d3f485d6bc48eb5e
                                                                                                                                                                • Instruction Fuzzy Hash: FA315E37A2EA4285EB15DF29E4400B8A764EF4AF98F181632EE5DC76D5DE3CE485C340
                                                                                                                                                                Function 00007FF677B281E0 Relevance: 7.6, APIs: 5, Instructions: 73COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 459529453-0
                                                                                                                                                                • Opcode ID: 026db704696174e835b50300a1f7a5a3ad76d15dad0c0758d04c95da3e0a5016
                                                                                                                                                                • Instruction ID: c74a9baed1d726c9dbb7e83fa07f0d2502a04390091eca42f95c696c4c3df27e
                                                                                                                                                                • Opcode Fuzzy Hash: 026db704696174e835b50300a1f7a5a3ad76d15dad0c0758d04c95da3e0a5016
                                                                                                                                                                • Instruction Fuzzy Hash: 59318F37E2AE4286EB15DF69E4401B86760EF5AF94F184632DE4DC76A5DE3CE4818340
                                                                                                                                                                Function 00007FF677B14CD8 Relevance: 7.6, APIs: 5, Instructions: 57COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetSecurityDescriptorControl.ADVAPI32(?,?,?,?,00000090,?,?,00007FF677B14CB6), ref: 00007FF677B14D01
                                                                                                                                                                • GetSecurityDescriptorOwner.ADVAPI32(?,?,?,?,00000090,?,?,00007FF677B14CB6), ref: 00007FF677B14D26
                                                                                                                                                                • GetSecurityDescriptorGroup.ADVAPI32(?,?,?,?,00000090,?,?,00007FF677B14CB6), ref: 00007FF677B14D41
                                                                                                                                                                • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?,00000090,?,?,00007FF677B14CB6), ref: 00007FF677B14D60
                                                                                                                                                                • GetSecurityDescriptorSacl.ADVAPI32(?,?,?,?,00000090,?,?,00007FF677B14CB6), ref: 00007FF677B14D84
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: DescriptorSecurity$ControlDaclGroupOwnerSacl
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1158139820-0
                                                                                                                                                                • Opcode ID: e9ee7312cf94f7b8848ef755becd87abbfb1773f27d93cd69ed6f4cefa265625
                                                                                                                                                                • Instruction ID: 531a14de112703f9b9bc101bd7d28fa88eddd4675cac9599a7f4614f17378c06
                                                                                                                                                                • Opcode Fuzzy Hash: e9ee7312cf94f7b8848ef755becd87abbfb1773f27d93cd69ed6f4cefa265625
                                                                                                                                                                • Instruction Fuzzy Hash: 8921A973A24A86D9EB50DF71D8418FC6360FB85F8CB495132EE0E96568DF38D989C350
                                                                                                                                                                Function 00007FF677B56900 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _set_statfp
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1156100317-0
                                                                                                                                                                • Opcode ID: 84855f71fc930a3f72be6f352999a63b35b857ca80910eb5122632ec7437490f
                                                                                                                                                                • Instruction ID: 3da2742e8265aa3ead0dbc318999ae29e54188436b47aeb8c84760d9b5029ef1
                                                                                                                                                                • Opcode Fuzzy Hash: 84855f71fc930a3f72be6f352999a63b35b857ca80910eb5122632ec7437490f
                                                                                                                                                                • Instruction Fuzzy Hash: 05115E33E78A4741FA941B68F4463795240AF9FF6CF080678ED6E866D6CE6C68C15200
                                                                                                                                                                Function 00007FF677B4A9A4 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • FlsGetValue.KERNEL32(?,?,?,00007FF677B38F77,?,?,00000000,00007FF677B39212,?,?,?,?,?,00007FF677B3919E), ref: 00007FF677B4A9C3
                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,?,00007FF677B38F77,?,?,00000000,00007FF677B39212,?,?,?,?,?,00007FF677B3919E), ref: 00007FF677B4A9E2
                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,?,00007FF677B38F77,?,?,00000000,00007FF677B39212,?,?,?,?,?,00007FF677B3919E), ref: 00007FF677B4AA0A
                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,?,00007FF677B38F77,?,?,00000000,00007FF677B39212,?,?,?,?,?,00007FF677B3919E), ref: 00007FF677B4AA1B
                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,?,00007FF677B38F77,?,?,00000000,00007FF677B39212,?,?,?,?,?,00007FF677B3919E), ref: 00007FF677B4AA2C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Value
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3702945584-0
                                                                                                                                                                • Opcode ID: 6f5c4c74f4857591930c30fa1196ac5472400d9b2f16d5e872f56a42fc86c974
                                                                                                                                                                • Instruction ID: e92607d5f39bbc11a7d532c668541c386d73d5e330e0a233afe8cfdcbdc4fb17
                                                                                                                                                                • Opcode Fuzzy Hash: 6f5c4c74f4857591930c30fa1196ac5472400d9b2f16d5e872f56a42fc86c974
                                                                                                                                                                • Instruction Fuzzy Hash: DF118E33E2D24211FA586F255A5517922429F46FB0F089336EC3DC77D6EE3CF801A240
                                                                                                                                                                Function 00007FF677B4A838 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Value
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3702945584-0
                                                                                                                                                                • Opcode ID: 13228be4287ebfa7e9ba8e4c4d9052b361f516d50cc4370b109d90732911e7db
                                                                                                                                                                • Instruction ID: 15f65a6b03e03c7fe070642726ebf096104268e4f78725d5b9a43d71493ded08
                                                                                                                                                                • Opcode Fuzzy Hash: 13228be4287ebfa7e9ba8e4c4d9052b361f516d50cc4370b109d90732911e7db
                                                                                                                                                                • Instruction Fuzzy Hash: 81113932E2D24312F968AF75445907923418F47F70F185B3AEC3ECA6D2EE2CB402B251
                                                                                                                                                                Function 00007FF677B1A814 Relevance: 7.5, APIs: 5, Instructions: 30sleepCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CountCriticalEnterSectionTick$Sleep
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1544504822-0
                                                                                                                                                                • Opcode ID: cbbff0fa93bb847e5869b074b5bc3fa5debe022b4ae7bc24e143cefb3031e3a5
                                                                                                                                                                • Instruction ID: 03851d3eaba07e1d431a317145e2291d310ed0d46c84f41b3e09dc80881b0e79
                                                                                                                                                                • Opcode Fuzzy Hash: cbbff0fa93bb847e5869b074b5bc3fa5debe022b4ae7bc24e143cefb3031e3a5
                                                                                                                                                                • Instruction Fuzzy Hash: 71F01D32A2868A82F7149F66F54803F6764AF46F84B105034DD5EC3A54DF3DE4868611
                                                                                                                                                                Function 00007FF677B36F98 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CallEncodePointerTranslator
                                                                                                                                                                • String ID: MOC$RCC
                                                                                                                                                                • API String ID: 3544855599-2084237596
                                                                                                                                                                • Opcode ID: d374d50f582ca31c03cf8d5e5df490c7ecde8975cf5d85ec95c791522cc1e212
                                                                                                                                                                • Instruction ID: 1275babf645897a9a728b261d0933690a5b819cd2f18b71eab4d45b865f2dcb9
                                                                                                                                                                • Opcode Fuzzy Hash: d374d50f582ca31c03cf8d5e5df490c7ecde8975cf5d85ec95c791522cc1e212
                                                                                                                                                                • Instruction Fuzzy Hash: 0991A373A18B859AE750CF75E8806AD7BA0FB06B88F10413AEE8D97755DF38E195C700
                                                                                                                                                                Function 00007FF677B19088 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 173COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Unescape
                                                                                                                                                                • String ID: [String contains non ascii chars]$[UrlUnescapeA failed][0x%08x]$base\string.cc
                                                                                                                                                                • API String ID: 927401054-2892996285
                                                                                                                                                                • Opcode ID: 1f60999b3988dc51a510573bae11c3ce4560708bb2355e1a8c67515b39899a50
                                                                                                                                                                • Instruction ID: b1a40533ba7963f1ea79314c65f7359d583c38780c448f8df2233002593cb79b
                                                                                                                                                                • Opcode Fuzzy Hash: 1f60999b3988dc51a510573bae11c3ce4560708bb2355e1a8c67515b39899a50
                                                                                                                                                                • Instruction Fuzzy Hash: 4B716D77B24A828AEB048F79D4541BC3761FB46FA8B104236DE2E87B99DF38D545C780
                                                                                                                                                                Function 00007FF677B20110 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 172COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
                                                                                                                                                                • String ID: bad locale name
                                                                                                                                                                • API String ID: 2775327233-1405518554
                                                                                                                                                                • Opcode ID: 67237ff9ba8ba33195e5339a4535b72184aef52b276514519e192137515dfadf
                                                                                                                                                                • Instruction ID: 5357da667ae00a33b7555a1662f5816dd06cd2ceec434159cb8dd1ec22376282
                                                                                                                                                                • Opcode Fuzzy Hash: 67237ff9ba8ba33195e5339a4535b72184aef52b276514519e192137515dfadf
                                                                                                                                                                • Instruction Fuzzy Hash: 9E714537A2AB818AEB14CF65D4901AC77A4FB89F84B088436EF8D93B59DF38D555C300
                                                                                                                                                                Function 00007FF677B29DA8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 165threadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Current$CountProcessThreadTick
                                                                                                                                                                • String ID: )]
                                                                                                                                                                • API String ID: 416392089-4238780332
                                                                                                                                                                • Opcode ID: 54cfef12ad902d9f540a803f742f96999abacf07e2a85b765f822caa6f3a21ef
                                                                                                                                                                • Instruction ID: 0f993d498243cdbe401415a0eb4989bb0d6daa1a524af7486703ee799a3de05f
                                                                                                                                                                • Opcode Fuzzy Hash: 54cfef12ad902d9f540a803f742f96999abacf07e2a85b765f822caa6f3a21ef
                                                                                                                                                                • Instruction Fuzzy Hash: 31615033B19A4295EB04EF65D4A52BD2361AF86F98F448432DE0EC775ADE3CE54AC340
                                                                                                                                                                Function 00007FF677B36D80 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CallEncodePointerTranslator
                                                                                                                                                                • String ID: MOC$RCC
                                                                                                                                                                • API String ID: 3544855599-2084237596
                                                                                                                                                                • Opcode ID: 5e61297c6616037b55df77a1f4e6760c5bcb61c0d9bbd516fbcdd6a40a287dc8
                                                                                                                                                                • Instruction ID: 9cde99503cae7e7b003e4e3c02671cf094a5358a855a7ded01d051973cffa2b4
                                                                                                                                                                • Opcode Fuzzy Hash: 5e61297c6616037b55df77a1f4e6760c5bcb61c0d9bbd516fbcdd6a40a287dc8
                                                                                                                                                                • Instruction Fuzzy Hash: DA514637A18A858AE7208F75D0803AD7BA0FB4AB8CF154226EF4D57B58CF38E585C700
                                                                                                                                                                Function 00007FF677B3750C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                • String ID: csm$csm
                                                                                                                                                                • API String ID: 3896166516-3733052814
                                                                                                                                                                • Opcode ID: f1dca27c9ae0d21d77c8ad65447529f6a74a98a9d6f4a90b12ed65234b08b227
                                                                                                                                                                • Instruction ID: 4fef1eeae4d477cc8a11824d0abc0460e8b2ae3133e841858e04dc7b72e080d0
                                                                                                                                                                • Opcode Fuzzy Hash: f1dca27c9ae0d21d77c8ad65447529f6a74a98a9d6f4a90b12ed65234b08b227
                                                                                                                                                                • Instruction Fuzzy Hash: 77514A33A2828287EB648F3595942687AA0FB57F99F144136DE9DC7B95CF3CE490CB01
                                                                                                                                                                Function 00007FF677B159F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00007FF677B19F54: GetModuleHandleW.KERNEL32(?,?,?,?,?,?,0100000000000000,00007FF677B15A23), ref: 00007FF677B19FC8
                                                                                                                                                                  • Part of subcall function 00007FF677B19F54: GetProcAddress.KERNEL32(?,?,?,?,?,?,0100000000000000,00007FF677B15A23), ref: 00007FF677B19FDD
                                                                                                                                                                  • Part of subcall function 00007FF677B19F54: RegisterTraceGuidsW.ADVAPI32 ref: 00007FF677B1A030
                                                                                                                                                                • OutputDebugStringW.KERNEL32 ref: 00007FF677B15A42
                                                                                                                                                                • OutputDebugStringW.KERNEL32 ref: 00007FF677B15B5C
                                                                                                                                                                  • Part of subcall function 00007FF677B19D4C: wvsprintfW.USER32 ref: 00007FF677B19E04
                                                                                                                                                                Strings
                                                                                                                                                                • LOG_SYSTEM: [%s]: ERROR - Cannot create log writer to %s, xrefs: 00007FF677B15B4A
                                                                                                                                                                • LOG_SYSTEM: [%s]: ERROR - Cannot create ETW log writer, xrefs: 00007FF677B15A33
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: DebugOutputString$AddressGuidsHandleModuleProcRegisterTracewvsprintf
                                                                                                                                                                • String ID: LOG_SYSTEM: [%s]: ERROR - Cannot create ETW log writer$LOG_SYSTEM: [%s]: ERROR - Cannot create log writer to %s
                                                                                                                                                                • API String ID: 1008358126-520088276
                                                                                                                                                                • Opcode ID: 50af30d22eb66cccdf0d220fb47d65e373da8d96d47f03fc53bb7847496ed22f
                                                                                                                                                                • Instruction ID: 50b920e76282e228c58ca2180199550fed8f462f01dd304c72e437d8c6cbb085
                                                                                                                                                                • Opcode Fuzzy Hash: 50af30d22eb66cccdf0d220fb47d65e373da8d96d47f03fc53bb7847496ed22f
                                                                                                                                                                • Instruction Fuzzy Hash: 19614D33B15A8286EB60DF69D8903B923A1EF42FA4F044235DE1D8BBD5DF2CD9848700
                                                                                                                                                                Function 00007FF677B118D0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 140COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleFileNameW.KERNEL32(?,?,00000000,00007FF677B119E3,?,?,?,?,?,?,?,?,?,?,?,00007FF677B11AF0), ref: 00007FF677B11947
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileModuleName
                                                                                                                                                                • String ID: T$[GetModuleName][module 0x%08x][path '%s'][name '%s']$base\app_util.cc
                                                                                                                                                                • API String ID: 514040917-917648062
                                                                                                                                                                • Opcode ID: 899b2fc36eb7308f483f604a505d247b94cc8f1b52b5920e018bd1f0f969fa3e
                                                                                                                                                                • Instruction ID: 6c4b0d52736a5fde71da22263f5dc5896b94f5e82c1a3a18b5d9dca6605c896e
                                                                                                                                                                • Opcode Fuzzy Hash: 899b2fc36eb7308f483f604a505d247b94cc8f1b52b5920e018bd1f0f969fa3e
                                                                                                                                                                • Instruction Fuzzy Hash: 38516D33B28A8582DB109F2AD45026967A1FB86F94F148635EF6D87B99DF3CE4418740
                                                                                                                                                                Function 00007FF677B1C454 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _invalid_parameter_noinfo_noreturn
                                                                                                                                                                • String ID: iostream
                                                                                                                                                                • API String ID: 3668304517-2522040138
                                                                                                                                                                • Opcode ID: 8cb404d399d666ab44d51be5f2fa88786d0accc35c60716641dcf45139147b74
                                                                                                                                                                • Instruction ID: 18fcb5e98d193df14c139d7c1d37fac9ac8d3bce5457d9a5f6ae305be51ba6c7
                                                                                                                                                                • Opcode Fuzzy Hash: 8cb404d399d666ab44d51be5f2fa88786d0accc35c60716641dcf45139147b74
                                                                                                                                                                • Instruction Fuzzy Hash: 25516973B24B498AFB009F64C4553BC2361EB4AB98F404635DE6C9AA99EF3CD158C384
                                                                                                                                                                Function 00007FF677B11ACC Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 113COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • PathRemoveExtensionW.SHLWAPI(?,?,?,?,?,?,?,?,00000000,0100000000000068,?,00007FF677B14ECE,?,?,0100000000000068,00007FF677B15C50), ref: 00007FF677B11B2E
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExtensionPathRemove
                                                                                                                                                                • String ID: [GetModuleNameWithoutExtension][module 0x%08x][module '%s'][name '%s']$_$base\app_util.cc
                                                                                                                                                                • API String ID: 2012694927-2958320832
                                                                                                                                                                • Opcode ID: 512fc1980898d8e966386778cfc2a2a73806f50f60c78ecb68791f4062c8fca0
                                                                                                                                                                • Instruction ID: 5d49059bb9986cca2f91305e55a95fe91dd775e4fda633d5c751a9dea2499a0d
                                                                                                                                                                • Opcode Fuzzy Hash: 512fc1980898d8e966386778cfc2a2a73806f50f60c78ecb68791f4062c8fca0
                                                                                                                                                                • Instruction Fuzzy Hash: 7A413B73B24A1586EB00DF39D8845AD3760FB86FA8B048636EE2D87799DF38D545C740
                                                                                                                                                                Function 00007FF677B1FF8C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
                                                                                                                                                                • String ID: bad locale name
                                                                                                                                                                • API String ID: 2775327233-1405518554
                                                                                                                                                                • Opcode ID: c5c05016ac2791a8b399e41a2ec26d7ac3aebc961476598ad9ec998b995d2650
                                                                                                                                                                • Instruction ID: bc0ea54d82798d990ed054cfd7ed211606d6a2c76fd9843923c58ebe55ee5e51
                                                                                                                                                                • Opcode Fuzzy Hash: c5c05016ac2791a8b399e41a2ec26d7ac3aebc961476598ad9ec998b995d2650
                                                                                                                                                                • Instruction Fuzzy Hash: 19413777B2AA818AEB14DF70D4901BC33A8EF46B88B044435EE4DA7B95CE38D561C310
                                                                                                                                                                Function 00007FF677B28B4C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
                                                                                                                                                                • String ID: bad locale name
                                                                                                                                                                • API String ID: 2775327233-1405518554
                                                                                                                                                                • Opcode ID: 6fbce709098beb2b3b71a1ae7974e17a4bb2d30b98fa3f65e7fc2e43b615e56d
                                                                                                                                                                • Instruction ID: 13c8eab9cd3dba9b1b8b0666bd9615b378cadf51fab2f187b16553f12bfc3d1a
                                                                                                                                                                • Opcode Fuzzy Hash: 6fbce709098beb2b3b71a1ae7974e17a4bb2d30b98fa3f65e7fc2e43b615e56d
                                                                                                                                                                • Instruction Fuzzy Hash: 7C413977A2AB81D9EB14DF70D4901FC23A4EF46B88B044435DE4D97B99CF38D5618310
                                                                                                                                                                Function 00007FF677B28DA8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
                                                                                                                                                                • String ID: bad locale name
                                                                                                                                                                • API String ID: 2775327233-1405518554
                                                                                                                                                                • Opcode ID: d3891e14807bb36e169cb923fc91099ea7f5d4c307832398059ec891b4ded735
                                                                                                                                                                • Instruction ID: a4665ca48aa1e8a7162ec4f879027d90d88200780abff8762a50bd34b59358c3
                                                                                                                                                                • Opcode Fuzzy Hash: d3891e14807bb36e169cb923fc91099ea7f5d4c307832398059ec891b4ded735
                                                                                                                                                                • Instruction Fuzzy Hash: 22413777A2AB81DAEB14EF70D4901BC33A4EF45B88B084935DE4DA7A95CF38D561C350
                                                                                                                                                                Function 00007FF677B19BAC Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00007FF677B199D4: GetFileAttributesExW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FF677B1648E,?,?,0100000000000068,00007FF677B15435,base\utils.cc), ref: 00007FF677B19A01
                                                                                                                                                                • MoveFileExW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF677B16D0F,?,?,?,00007FF677B16B39), ref: 00007FF677B19C52
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$AttributesMove
                                                                                                                                                                • String ID: [File::MoveAfterReboot][failed to MoveFileEx from '%s' to '%s'][0x%x]$[File::MoveAfterReboot][file doesn't exist][from %s]$base\file.cc
                                                                                                                                                                • API String ID: 3192009998-2517278875
                                                                                                                                                                • Opcode ID: d15e1af328d0066cdd8455a37369da4cc6cc43b57eabf8aebf571556996293cb
                                                                                                                                                                • Instruction ID: 1a2cf4c352357001cdc908b4d584873b05a1a1f58fc1b9943a48ec5854796dc5
                                                                                                                                                                • Opcode Fuzzy Hash: d15e1af328d0066cdd8455a37369da4cc6cc43b57eabf8aebf571556996293cb
                                                                                                                                                                • Instruction Fuzzy Hash: F5317973B2869289EB008F61E8901FD37A5AB06F88F504536DE5D97B99DF3CE505CB40
                                                                                                                                                                Function 00007FF677B29A24 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$CreateModuleNamePointer
                                                                                                                                                                • String ID: debug.log
                                                                                                                                                                • API String ID: 3112930533-600467936
                                                                                                                                                                • Opcode ID: b96799d7c9893e028a6bbebbee225863899c7acc3ea7668a0324ec3449f52d32
                                                                                                                                                                • Instruction ID: 61de38bf3251e433fd05a6f3418d934311c36dde781c78d6b50e953e23ddd133
                                                                                                                                                                • Opcode Fuzzy Hash: b96799d7c9893e028a6bbebbee225863899c7acc3ea7668a0324ec3449f52d32
                                                                                                                                                                • Instruction Fuzzy Hash: 61115C72A3964282FB90DF70E8956B522A0BF47B60F805236DD5ED26E0DF7CA5458780
                                                                                                                                                                Function 00007FF677B1A72C Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 25COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: HandleModule
                                                                                                                                                                • String ID: CreateEventExW$CreateMutexExW$kernel32.dll
                                                                                                                                                                • API String ID: 4139908857-2423819206
                                                                                                                                                                • Opcode ID: b49edd327dce6e0f9f316f64ae58d1496f763662e4054213fe82edaccab7acf3
                                                                                                                                                                • Instruction ID: 7cc56a260e4e82d309d8477f73d9c76e533f43ee39f3d2d1e7e1eadbe64a77e7
                                                                                                                                                                • Opcode Fuzzy Hash: b49edd327dce6e0f9f316f64ae58d1496f763662e4054213fe82edaccab7acf3
                                                                                                                                                                • Instruction Fuzzy Hash: 58F0BD77E3AA0650FA569F50D8843B012B16F47F60F440032CD0CC52A5EF2CB686C250
                                                                                                                                                                Function 00007FF677B160AA Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                • Unexpected exception in: omaha::Logging::InternalLogMessageMaskedVA, xrefs: 00007FF677B160AA
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: DebugOutputString
                                                                                                                                                                • String ID: Unexpected exception in: omaha::Logging::InternalLogMessageMaskedVA
                                                                                                                                                                • API String ID: 1166629820-3049550389
                                                                                                                                                                • Opcode ID: 7261980b445e286e62560be471b6435dff4da421cf4dd618819ce1b52ee09f68
                                                                                                                                                                • Instruction ID: 31a911db4d1e8c33cea1648a4513a0304594857ef40d2b7a77e210a6a171dc91
                                                                                                                                                                • Opcode Fuzzy Hash: 7261980b445e286e62560be471b6435dff4da421cf4dd618819ce1b52ee09f68
                                                                                                                                                                • Instruction Fuzzy Hash: 89E0263392454682EA129F14FC557796710AB9AB76F400032CE1EC5570DF3C95DA8310
                                                                                                                                                                Function 00007FF677B57A2C Relevance: 6.3, APIs: 4, Instructions: 305fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2718003287-0
                                                                                                                                                                • Opcode ID: aacf3207be678512039d44c56d29ddf37465af7349235994fcc809ab7cb8f6e0
                                                                                                                                                                • Instruction ID: b260a348dc2dc84fea08aeb2b07a627df99a5683530fcbc202b66166d834174e
                                                                                                                                                                • Opcode Fuzzy Hash: aacf3207be678512039d44c56d29ddf37465af7349235994fcc809ab7cb8f6e0
                                                                                                                                                                • Instruction Fuzzy Hash: D5D11433B28A818AE711CF79E4402AC37B5FB46B98B544236DF5D97B99CE38D586C700
                                                                                                                                                                Function 00007FF677B58370 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00007FF677B58310), ref: 00007FF677B58493
                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00007FF677B58310), ref: 00007FF677B5851D
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ConsoleErrorLastMode
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 953036326-0
                                                                                                                                                                • Opcode ID: 86f375b1be49f427c4a2d5f7077b3e0702b04ec3eabd9a40d13703cff71fe9e6
                                                                                                                                                                • Instruction ID: ce2ee2794a68ad960ae6877d801b9e41273b335458ffd576edd551bc880a816b
                                                                                                                                                                • Opcode Fuzzy Hash: 86f375b1be49f427c4a2d5f7077b3e0702b04ec3eabd9a40d13703cff71fe9e6
                                                                                                                                                                • Instruction Fuzzy Hash: C991AE73A28A528AFB509F65F8806BD27A0FB06F88F444136DE0E97A94DF38D4C5C710
                                                                                                                                                                Function 00007FF677B17834 Relevance: 6.2, APIs: 4, Instructions: 175COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AbsoluteMake$ControlDescriptorErrorLastSecurity
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3769124138-0
                                                                                                                                                                • Opcode ID: 6461d7d670499baa03d94653bb11b6cfd2552110c850c557b06006fa92a7f81b
                                                                                                                                                                • Instruction ID: 9ba85408e4e181daf4dd5425885bf91fef48a35f3bb428044b0c47519aeafc4f
                                                                                                                                                                • Opcode Fuzzy Hash: 6461d7d670499baa03d94653bb11b6cfd2552110c850c557b06006fa92a7f81b
                                                                                                                                                                • Instruction Fuzzy Hash: AD616F37A287869AE7149F71E8405BE63A5FB46BC8F140435EE4D87B99DF38E948C340
                                                                                                                                                                Function 00007FF677B4083C Relevance: 6.1, APIs: 4, Instructions: 99COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3215553584-0
                                                                                                                                                                • Opcode ID: 9d119feb492967d7840523dcf7da1bc3eb964b154d587926480cba39bf0d9b4b
                                                                                                                                                                • Instruction ID: 81b1e45bce12f21dce3b04605d727215dd38aed269463f87d1010476e1e7c39c
                                                                                                                                                                • Opcode Fuzzy Hash: 9d119feb492967d7840523dcf7da1bc3eb964b154d587926480cba39bf0d9b4b
                                                                                                                                                                • Instruction Fuzzy Hash: A2412E33928AC586FB629F35E8502BD3BA4EB06F48F498071DE8C87746CE3D9445D352
                                                                                                                                                                Function 00007FF677B30EC8 Relevance: 6.1, APIs: 4, Instructions: 91COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • EnterCriticalSection.KERNEL32(?,?,?,00007FF677B11414,?,?,?,00007FF677B11DC4,?,?,?,00007FF677B151E8), ref: 00007FF677B30EE6
                                                                                                                                                                • LeaveCriticalSection.KERNEL32(?,?,?,00007FF677B11414,?,?,?,00007FF677B11DC4,?,?,?,00007FF677B151E8), ref: 00007FF677B30F04
                                                                                                                                                                • _set_fmode.LIBCMT ref: 00007FF677B30F57
                                                                                                                                                                • _RTC_Initialize.LIBCMT ref: 00007FF677B30F78
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CriticalSection$EnterInitializeLeave_set_fmode
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2803588085-0
                                                                                                                                                                • Opcode ID: 6b439639290101aa0f14decfbbc03a6bdd69a8f6e1fc8c9d35c7318b366db075
                                                                                                                                                                • Instruction ID: e3fc48984b175e84d24aa94511cdde7d5ae0b294eb041bf8e342433f62866d26
                                                                                                                                                                • Opcode Fuzzy Hash: 6b439639290101aa0f14decfbbc03a6bdd69a8f6e1fc8c9d35c7318b366db075
                                                                                                                                                                • Instruction Fuzzy Hash: 07310737E28A4B87FA247FB1A4821BD5265DF96F44F400830EE5DC6697DE2CF4818751
                                                                                                                                                                Function 00007FF677B14DB0 Relevance: 6.1, APIs: 4, Instructions: 72COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: DescriptorSecurity$ControlLengthMakeRelativeSelf_invalid_parameter_noinfo
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 655417856-0
                                                                                                                                                                • Opcode ID: 20f891cd82a220dc9a34b0c9530a5b714dc3c72d4a69e0599ae3e18be37084bb
                                                                                                                                                                • Instruction ID: bcc8ceef957d9839aa3627bdaf4a72b2108e4f31284ba7b0b0cd40036b8a2a1a
                                                                                                                                                                • Opcode Fuzzy Hash: 20f891cd82a220dc9a34b0c9530a5b714dc3c72d4a69e0599ae3e18be37084bb
                                                                                                                                                                • Instruction Fuzzy Hash: 01216273A2874642EA48AF71E5543B95291EF86F80F188834EF5DC7686EF3CE4948700
                                                                                                                                                                Function 00007FF677B1C250 Relevance: 6.0, APIs: 4, Instructions: 50COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Trace$Enable$ErrorFlagsHandleLastLevelLogger
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 101358600-0
                                                                                                                                                                • Opcode ID: 7bcfec29393a223070e52b1e2ea1c9dcc15f8a2d79145c134989f331b0deb933
                                                                                                                                                                • Instruction ID: ffc4331b11162c7cdf17ff9926089c8106586c26f0e854cc45df543f2db63d88
                                                                                                                                                                • Opcode Fuzzy Hash: 7bcfec29393a223070e52b1e2ea1c9dcc15f8a2d79145c134989f331b0deb933
                                                                                                                                                                • Instruction Fuzzy Hash: C4114273A6874683EA684FA9E55413966A0FF1EF50B044179CE0FC3B50DF38E4588740
                                                                                                                                                                Function 00007FF677B1AC00 Relevance: 6.0, APIs: 4, Instructions: 41COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ConditionMask$InfoVerifyVersion
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2793162063-0
                                                                                                                                                                • Opcode ID: 5557177bb6dc0a875bda8b400bcfd6e11e753ed29cbecd88bb6ac4ced961ea1a
                                                                                                                                                                • Instruction ID: 0cce0c37bd74917056ca35e482eed02dbe9cebd160bb2df11bec8e9d856f0f28
                                                                                                                                                                • Opcode Fuzzy Hash: 5557177bb6dc0a875bda8b400bcfd6e11e753ed29cbecd88bb6ac4ced961ea1a
                                                                                                                                                                • Instruction Fuzzy Hash: 7A111833629A8586E720CF61E8553EAB3A1EB89B44F414535CA4D8B768EF3CD248CB44
                                                                                                                                                                Function 00007FF677B4FE8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 193COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00007FF677B4F7E8: GetOEMCP.KERNEL32(?,?,?,?,?,?,FFFFFFFD,00007FF677B4FB24), ref: 00007FF677B4F812
                                                                                                                                                                • IsValidCodePage.KERNEL32(?,?,?,00000001,?,00000000,AVGBrowserUpdate.log,00007FF677B4FC55), ref: 00007FF677B4FEF9
                                                                                                                                                                • GetCPInfo.KERNEL32(?,?,?,00000001,?,00000000,AVGBrowserUpdate.log,00007FF677B4FC55), ref: 00007FF677B4FF45
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CodeInfoPageValid
                                                                                                                                                                • String ID: AVGBrowserUpdate.log
                                                                                                                                                                • API String ID: 546120528-3109684163
                                                                                                                                                                • Opcode ID: d39f28dbaa3971d37c6de0e0e2de8a252f542dc3c18b26140cc007853bcf9477
                                                                                                                                                                • Instruction ID: e9da96e162da6b3c160244a286759c53cacc98785cefd9db6d4e6ea12bc15924
                                                                                                                                                                • Opcode Fuzzy Hash: d39f28dbaa3971d37c6de0e0e2de8a252f542dc3c18b26140cc007853bcf9477
                                                                                                                                                                • Instruction Fuzzy Hash: 9581DB73A296868AF7658F25E0101797BA1EB46F80F5C4136DE8EC7690EE3DF681D301
                                                                                                                                                                Function 00007FF677B37744 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: __except_validate_context_record
                                                                                                                                                                • String ID: csm$csm
                                                                                                                                                                • API String ID: 1467352782-3733052814
                                                                                                                                                                • Opcode ID: c02fccc6b20108cb8d9c10ac7f086e10abc280d7e8ef4db3119b972c7ee01880
                                                                                                                                                                • Instruction ID: 904f330296ff78935cace25cefa62e09b09e5cb2b0a6e00c3b8330bc193da1e8
                                                                                                                                                                • Opcode Fuzzy Hash: c02fccc6b20108cb8d9c10ac7f086e10abc280d7e8ef4db3119b972c7ee01880
                                                                                                                                                                • Instruction Fuzzy Hash: D6716C73A2868197DB648F3594947797BA0FB46F89F148236DE8C87B85CE3CE491C740
                                                                                                                                                                Function 00007FF677B4D5AC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                • String ID: ?
                                                                                                                                                                • API String ID: 1286766494-1684325040
                                                                                                                                                                • Opcode ID: a3370900ab0784a6ce59129017ad263afcceaf1e95927229a594eaaa9fce7e0e
                                                                                                                                                                • Instruction ID: ea5c593d8a48afb1f1bf774595c5baa2695748d1c617aa3adf069ff066908ca8
                                                                                                                                                                • Opcode Fuzzy Hash: a3370900ab0784a6ce59129017ad263afcceaf1e95927229a594eaaa9fce7e0e
                                                                                                                                                                • Instruction Fuzzy Hash: 65411433A2878252FBA49F25E40537A67A0EB82FA4F544235EF5C86BD5DE3CD4919700
                                                                                                                                                                Function 00007FF677B37D74 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateFrameInfo__except_validate_context_record
                                                                                                                                                                • String ID: csm
                                                                                                                                                                • API String ID: 2558813199-1018135373
                                                                                                                                                                • Opcode ID: 3f8105311d3d4c474a3463ae7a5416ca912e5cb3f6e74d6b624f5bdc326c875f
                                                                                                                                                                • Instruction ID: 2fb5c25c4565448951e799297e89ac20389afc32292952850be60b0a9cae2ad3
                                                                                                                                                                • Opcode Fuzzy Hash: 3f8105311d3d4c474a3463ae7a5416ca912e5cb3f6e74d6b624f5bdc326c875f
                                                                                                                                                                • Instruction Fuzzy Hash: 60512B77A2968197E620AF35E48426D7BE4FB8AB90F100134EF8D87B55DF38E491CB00
                                                                                                                                                                Function 00007FF677B46624 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • _invalid_parameter_noinfo.LIBCMT ref: 00007FF677B46656
                                                                                                                                                                  • Part of subcall function 00007FF677B4AAC4: HeapFree.KERNEL32(?,?,00007FF677B48A35,00007FF677B5163A,?,?,?,00007FF677B519B7,?,?,00000000,00007FF677B51F98,?,?,?,00007FF677B51ECB), ref: 00007FF677B4AADA
                                                                                                                                                                  • Part of subcall function 00007FF677B4AAC4: GetLastError.KERNEL32(?,?,00007FF677B48A35,00007FF677B5163A,?,?,?,00007FF677B519B7,?,?,00000000,00007FF677B51F98,?,?,?,00007FF677B51ECB), ref: 00007FF677B4AAE4
                                                                                                                                                                Strings
                                                                                                                                                                • AVGBrowserUpdate.log, xrefs: 00007FF677B4662A
                                                                                                                                                                • C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe, xrefs: 00007FF677B46667
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorFreeHeapLast_invalid_parameter_noinfo
                                                                                                                                                                • String ID: AVGBrowserUpdate.log$C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe
                                                                                                                                                                • API String ID: 2724796048-3131876355
                                                                                                                                                                • Opcode ID: a74639b211147f149a163d31a53027056bbc3176fd15632ff8888e900c659be0
                                                                                                                                                                • Instruction ID: 5786abbf120571740f6a58260e293ef05bdcc14452ef4817b2fbc9299571f59e
                                                                                                                                                                • Opcode Fuzzy Hash: a74639b211147f149a163d31a53027056bbc3176fd15632ff8888e900c659be0
                                                                                                                                                                • Instruction Fuzzy Hash: 9F417077A28B5286FB14DF25A5400B827A4EF4AF98F544036EE4EC7B96DE3CE481D740
                                                                                                                                                                Function 00007FF677B29898 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101synchronizationCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateMutex_invalid_parameter_noinfo_noreturn
                                                                                                                                                                • String ID: Global\
                                                                                                                                                                • API String ID: 1132242804-188423391
                                                                                                                                                                • Opcode ID: 3d07b8343de3e12ddec6debeda40942f58d0242e08a855c68423b4c3a66c7bcc
                                                                                                                                                                • Instruction ID: bc0336b7bbe8b3d8f30a22c3c0a7d69a00f2a4cda5a56a41bdd76dc3b5d8fb06
                                                                                                                                                                • Opcode Fuzzy Hash: 3d07b8343de3e12ddec6debeda40942f58d0242e08a855c68423b4c3a66c7bcc
                                                                                                                                                                • Instruction Fuzzy Hash: 40413A32B25A6189FB00CFB8E8952AC2375FB46BA8F504536DE5DA7A98DF78D045C340
                                                                                                                                                                Function 00007FF677B580D8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorFileLastWrite
                                                                                                                                                                • String ID: U
                                                                                                                                                                • API String ID: 442123175-4171548499
                                                                                                                                                                • Opcode ID: a4079c4a59b11653cfe9363fa8a4f741b59040f47f80ab86ac50e83a903814c8
                                                                                                                                                                • Instruction ID: 9d40cf4a45040064acd6c3721257dcd4e2f5ee373cfca868913de38aa3d8f027
                                                                                                                                                                • Opcode Fuzzy Hash: a4079c4a59b11653cfe9363fa8a4f741b59040f47f80ab86ac50e83a903814c8
                                                                                                                                                                • Instruction Fuzzy Hash: C741A233B28A8586DB609F65F8443AA6761FB89B94F944131EE4DC7798DF3CD481C740
                                                                                                                                                                Function 00007FF677B21064 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Path$FromStringStrip
                                                                                                                                                                • String ID: [invalid offline_dir_name. Needs to be a guid][%s][%#x]$common\command_line_builder.cc
                                                                                                                                                                • API String ID: 1729496438-4065959317
                                                                                                                                                                • Opcode ID: 2694b8059b9121f5a8e8469b993c630d02e3279fac7510c6bdc382de85802304
                                                                                                                                                                • Instruction ID: b71dad1abf58a3a6a076e3090226ca303e2af9a7a3ebff84a4998fa356ff709d
                                                                                                                                                                • Opcode Fuzzy Hash: 2694b8059b9121f5a8e8469b993c630d02e3279fac7510c6bdc382de85802304
                                                                                                                                                                • Instruction Fuzzy Hash: 96318A73B24A9589FB00CF65D8510AC37B0BB8AF98B544236DE1DA7B54EF38D545C740
                                                                                                                                                                Function 00007FF677B1A890 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressProc
                                                                                                                                                                • String ID: D:\work\80d73d2491516fd8\omaha\omaha/base/utils.h$[GetProcAddress failed %s]
                                                                                                                                                                • API String ID: 190572456-2236554921
                                                                                                                                                                • Opcode ID: 21ce0d5a1cba340d1ecfec74e01bb28f8a1fc01921e94c123d0528aff111453f
                                                                                                                                                                • Instruction ID: aa09c27591a1d930bc612d405babc3134d7a7f61b4b01fa57614a064b9707b52
                                                                                                                                                                • Opcode Fuzzy Hash: 21ce0d5a1cba340d1ecfec74e01bb28f8a1fc01921e94c123d0528aff111453f
                                                                                                                                                                • Instruction Fuzzy Hash: 00218173A29A8685EE618F10E8503BA73A0EF86F94F444135DE9D86B94DF3CE484CB00
                                                                                                                                                                Function 00007FF677B4E580 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _set_errno_from_matherr
                                                                                                                                                                • String ID: exp
                                                                                                                                                                • API String ID: 1187470696-113136155
                                                                                                                                                                • Opcode ID: 333448b56095f5fa086717bf08f0ccf2d1cf056bcd5be7b16ef5f1d1c04aa24d
                                                                                                                                                                • Instruction ID: d633440a82d6f2e701425b49bda9ded7093a97350984df74124e0a815a6c378c
                                                                                                                                                                • Opcode Fuzzy Hash: 333448b56095f5fa086717bf08f0ccf2d1cf056bcd5be7b16ef5f1d1c04aa24d
                                                                                                                                                                • Instruction Fuzzy Hash: 2F211536E256158EEB50CFB8C4406AD37B0FB49B48F041535EE0ED2B4AEE38E5409B40
                                                                                                                                                                Function 00007FF677B19A20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetFileAttributesExW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000004,00007FF677B19C41), ref: 00007FF677B19A55
                                                                                                                                                                  • Part of subcall function 00007FF677B13FC8: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF677B13A30,base\utils.cc,?,00000028,00007FF677B12654), ref: 00007FF677B13FCE
                                                                                                                                                                  • Part of subcall function 00007FF677B13FC8: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,00007FF677B13A30,base\utils.cc,?,00000028,00007FF677B12654), ref: 00007FF677B14007
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AttributesErrorExceptionFileLastRaise
                                                                                                                                                                • String ID: [File::IsDirectory - GetFileAttributesEx failed][%s][0x%x]$base\file.cc
                                                                                                                                                                • API String ID: 2337236205-913063920
                                                                                                                                                                • Opcode ID: 73d5712e10ffec4c6561f929672265b3954207ffe25a048ba98430b24f87be67
                                                                                                                                                                • Instruction ID: 22de4a2091b13260eec8bd1322ee73a138bcc4d28dc7caf7bb1514afc4801c5c
                                                                                                                                                                • Opcode Fuzzy Hash: 73d5712e10ffec4c6561f929672265b3954207ffe25a048ba98430b24f87be67
                                                                                                                                                                • Instruction Fuzzy Hash: CC11A573A38A8142EB10CF25E4413BA77A0FF87B84F504135EA8D87665DF3CE1498B00
                                                                                                                                                                Function 00007FF677B19AF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • MoveFileExW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF677B16CE7,?,?,?,00007FF677B16B39), ref: 00007FF677B19B0B
                                                                                                                                                                  • Part of subcall function 00007FF677B13FC8: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF677B13A30,base\utils.cc,?,00000028,00007FF677B12654), ref: 00007FF677B13FCE
                                                                                                                                                                  • Part of subcall function 00007FF677B13FC8: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,00007FF677B13A30,base\utils.cc,?,00000028,00007FF677B12654), ref: 00007FF677B14007
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorExceptionFileLastMoveRaise
                                                                                                                                                                • String ID: [File::Move - MoveFileEx failed][from=%s][to=%s][replace=%u][0x%x]$base\file.cc
                                                                                                                                                                • API String ID: 1690405315-1554429307
                                                                                                                                                                • Opcode ID: 8a40914a7d829eb9edd44507867b8f2fc100d09ac47bc734374e22234362763a
                                                                                                                                                                • Instruction ID: 99ed7b38e9ec901c33a87c4119fdaab6102fb570312071709340b5b9d8d95f8a
                                                                                                                                                                • Opcode Fuzzy Hash: 8a40914a7d829eb9edd44507867b8f2fc100d09ac47bc734374e22234362763a
                                                                                                                                                                • Instruction Fuzzy Hash: 6B116D73A3868286E7508F25E48016A7BA4EB46B84F544639FE8D87BA9DF7CD5448B00
                                                                                                                                                                Function 00007FF677B35718 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,1FFFFFFFFFFFFFFF,00007FF677B322E6), ref: 00007FF677B3575C
                                                                                                                                                                • RaiseException.KERNEL32(?,?,?,?,?,?,?,?,1FFFFFFFFFFFFFFF,00007FF677B322E6), ref: 00007FF677B357A2
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                • String ID: csm
                                                                                                                                                                • API String ID: 2573137834-1018135373
                                                                                                                                                                • Opcode ID: d1ee27406ee44bf3306dd229749bc9deb1c91f9af3e6035255c59403cec067aa
                                                                                                                                                                • Instruction ID: 74ee06b6c00b63c759ec4933ede7d07f566f5f0b5623a5997bc463e4dafef8d4
                                                                                                                                                                • Opcode Fuzzy Hash: d1ee27406ee44bf3306dd229749bc9deb1c91f9af3e6035255c59403cec067aa
                                                                                                                                                                • Instruction Fuzzy Hash: 16113D36628B45C2EB618F25F4402697BA5FB89F84F184230DE8D47768DF3CD5958B00
                                                                                                                                                                Function 00007FF677B5A141 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: DebugDebuggerOutputPresentString
                                                                                                                                                                • String ID: **SehSendMinidump**
                                                                                                                                                                • API String ID: 4086329628-2587082360
                                                                                                                                                                • Opcode ID: bcf12adf95d72f0dca7a5772e72458033a0bab04bb93fb1d80f52e0b4dd02500
                                                                                                                                                                • Instruction ID: d7933632781be776ab5019bd3b30159c5f552a64b76129c0271092d453ed0a3c
                                                                                                                                                                • Opcode Fuzzy Hash: bcf12adf95d72f0dca7a5772e72458033a0bab04bb93fb1d80f52e0b4dd02500
                                                                                                                                                                • Instruction Fuzzy Hash: 9701C077A14A46CAE714CF25E8806A93BA4FF4AF98F204035DE0DD7764DF39E8858750
                                                                                                                                                                Function 00007FF677B17250 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24synchronizationCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: DebugObjectOutputSingleStringWait
                                                                                                                                                                • String ID: LOG_SYSTEM: [%s]: Could not acquire logging mutex %s
                                                                                                                                                                • API String ID: 3023325665-3861772780
                                                                                                                                                                • Opcode ID: 5627f37811cccce364cc0d77bcb4056518ad50273c36c6d4091034e8a6e5b3e4
                                                                                                                                                                • Instruction ID: b0295253384f032a7ef633af9b15b4fc49bdb2c6f8c71e2997413c05f475b2d3
                                                                                                                                                                • Opcode Fuzzy Hash: 5627f37811cccce364cc0d77bcb4056518ad50273c36c6d4091034e8a6e5b3e4
                                                                                                                                                                • Instruction Fuzzy Hash: C0F01C72A2C54281FE148FA5E4442792350EF57F54F185471ED1D8B294DE2CD8869390
                                                                                                                                                                Function 00007FF677B59F80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __C_specific_handler.LIBVCRUNTIME ref: 00007FF677B59F90
                                                                                                                                                                  • Part of subcall function 00007FF677B343E8: __except_validate_context_record.LIBVCRUNTIME ref: 00007FF677B34413
                                                                                                                                                                  • Part of subcall function 00007FF677B343E8: _IsNonwritableInCurrentImage.LIBCMT ref: 00007FF677B344A8
                                                                                                                                                                  • Part of subcall function 00007FF677B343E8: RtlUnwindEx.KERNEL32 ref: 00007FF677B344F7
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: C_specific_handlerCurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                • String ID: csm$f
                                                                                                                                                                • API String ID: 3112662972-629598281
                                                                                                                                                                • Opcode ID: 738ebc9cbb834bd0d2a36c198a0d791dbdc2edc39ac52a5c055a4454c19e6e1b
                                                                                                                                                                • Instruction ID: 4cf534e8607cf94cbc098bb59e31a0d9679992a39041026575bbfd9422172478
                                                                                                                                                                • Opcode Fuzzy Hash: 738ebc9cbb834bd0d2a36c198a0d791dbdc2edc39ac52a5c055a4454c19e6e1b
                                                                                                                                                                • Instruction Fuzzy Hash: C3E03033D2838681EA642F31B18527C6A90DF06F44F148134DE484B786CE7DE4D08605
                                                                                                                                                                Function 00007FF677B18824 Relevance: 5.1, APIs: 4, Instructions: 77COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2189440511.00007FF677B11000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00007FF677B10000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2189243065.00007FF677B10000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2189908666.00007FF677B5B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190011620.00007FF677B73000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2190039680.00007FF677B77000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_7ff677b10000_AVGBrowserUpdateComRegisterShell64.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ByteCharMultiWide$ErrorLast
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1717984340-0
                                                                                                                                                                • Opcode ID: 61fe7adcfd507dc3eb6ab2ca3e10c71fd2683bd90fc723e921407bf5c162d56b
                                                                                                                                                                • Instruction ID: 7cf5e4340dc36a6f8aa4ff4b85e13f32f1882ca00dea20edc2204811436bcee9
                                                                                                                                                                • Opcode Fuzzy Hash: 61fe7adcfd507dc3eb6ab2ca3e10c71fd2683bd90fc723e921407bf5c162d56b
                                                                                                                                                                • Instruction Fuzzy Hash: 4F21BA33A24B8186EB10CF62E84426ABBA4FB8AFD4F084134DF4C93B65DF38E5558700

                                                                                                                                                                Callgraph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                • Opacity -> Relevance
                                                                                                                                                                • Disassembly available
                                                                                                                                                                callgraph 0 Function_00007FF73BED3A10 1 Function_00007FF73BED3C10 14 Function_00007FF73BED1D80 1->14 15 Function_00007FF73BED1D40 1->15 31 Function_00007FF73BED1EF0 1->31 32 Function_00007FF73BED1E30 1->32 40 Function_00007FF73BED1D20 1->40 2 Function_00007FF73BED2190 3 Function_00007FF73BED3690 4 Function_00007FF73BED2090 4->3 21 Function_00007FF73BED3900 4->21 28 Function_00007FF73BED3830 4->28 29 Function_00007FF73BED3B70 4->29 34 Function_00007FF73BED3930 4->34 38 Function_00007FF73BED3660 4->38 5 Function_00007FF73BED2C50 7 Function_00007FF73BED36D0 5->7 25 Function_00007FF73BED2B70 5->25 6 Function_00007FF73BED1050 8 Function_00007FF73BED1C50 9 Function_00007FF73BED12C0 9->15 9->31 9->32 33 Function_00007FF73BED1030 9->33 9->40 41 Function_00007FF73BED1E20 9->41 10 Function_00007FF73BED2D80 10->3 10->5 10->7 20 Function_00007FF73BED3600 10->20 10->38 11 Function_00007FF73BED22C0 11->1 11->3 11->7 11->8 11->9 36 Function_00007FF73BED1A60 11->36 11->38 12 Function_00007FF73BED1F00 12->21 12->29 30 Function_00007FF73BED39B0 12->30 37 Function_00007FF73BED3A60 12->37 13 Function_00007FF73BED1FC0 13->0 13->7 13->21 27 Function_00007FF73BED3730 13->27 13->29 13->34 14->3 16 Function_00007FF73BED10C0 17 Function_00007FF73BED11C0 16->17 39 Function_00007FF73BED3AA0 16->39 18 Function_00007FF73BED2F00 18->2 18->3 18->4 18->6 18->7 18->10 18->11 18->12 18->13 18->16 19 Function_00007FF73BED2AC0 18->19 18->21 22 Function_00007FF73BED38C0 18->22 24 Function_00007FF73BED1080 18->24 26 Function_00007FF73BED3D30 18->26 18->29 35 Function_00007FF73BED27B0 18->35 18->36 18->37 19->36 19->38 23 Function_00007FF73BED1000 23->18 29->3 29->7 35->2 35->3 35->4 35->7

                                                                                                                                                                Executed Functions

                                                                                                                                                                Function 00007FF73BED12C0 Relevance: 51.0, APIs: 23, Strings: 6, Instructions: 266memorylibraryloaderCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 0 7ff73bed12c0-7ff73bed12e9 1 7ff73bed12ef-7ff73bed1330 GetProcAddress * 3 0->1 2 7ff73bed1620-7ff73bed1652 call 7ff73bed1030 ExpandEnvironmentStringsW 0->2 4 7ff73bed1337-7ff73bed1341 1->4 8 7ff73bed1654-7ff73bed165b 2->8 9 7ff73bed165d-7ff73bed1673 LoadLibraryW 2->9 6 7ff73bed15f3-7ff73bed160c 4->6 7 7ff73bed1347-7ff73bed134f 4->7 7->6 10 7ff73bed1355-7ff73bed1358 7->10 12 7ff73bed167a-7ff73bed167d 8->12 9->12 10->6 11 7ff73bed135e-7ff73bed136f lstrlenW 10->11 13 7ff73bed1381-7ff73bed1384 11->13 14 7ff73bed1371-7ff73bed1376 11->14 12->1 15 7ff73bed1683-7ff73bed16a7 ExpandEnvironmentStringsW 12->15 19 7ff73bed15cd-7ff73bed15cf 13->19 20 7ff73bed138a-7ff73bed13c1 WideCharToMultiByte 13->20 14->13 18 7ff73bed1378-7ff73bed137f 14->18 16 7ff73bed16b2-7ff73bed16c8 LoadLibraryExW 15->16 17 7ff73bed16a9-7ff73bed16b0 15->17 21 7ff73bed16cf-7ff73bed16d2 16->21 17->21 18->13 18->14 19->6 22 7ff73bed13c3-7ff73bed13e1 GetProcessHeap HeapAlloc 20->22 23 7ff73bed1410-7ff73bed1441 WideCharToMultiByte 20->23 21->1 24 7ff73bed16d8-7ff73bed16fc ExpandEnvironmentStringsW 21->24 22->23 25 7ff73bed13e3-7ff73bed140d WideCharToMultiByte 22->25 26 7ff73bed15d1-7ff73bed15d3 23->26 27 7ff73bed1447-7ff73bed146d GetProcessHeap HeapAlloc 23->27 29 7ff73bed16fe-7ff73bed1705 24->29 30 7ff73bed1707-7ff73bed171d LoadLibraryExW 24->30 25->23 28 7ff73bed15d8-7ff73bed15db 26->28 27->26 31 7ff73bed1473-7ff73bed149f WideCharToMultiByte 27->31 28->6 32 7ff73bed15dd-7ff73bed15f1 GetProcessHeap HeapFree 28->32 33 7ff73bed1724-7ff73bed1727 29->33 30->33 34 7ff73bed14a1-7ff73bed14a4 31->34 35 7ff73bed14aa-7ff73bed14ad 31->35 32->6 33->1 36 7ff73bed172d-7ff73bed1734 33->36 34->35 37 7ff73bed15b3 35->37 38 7ff73bed14b3-7ff73bed1523 35->38 36->4 39 7ff73bed15b5-7ff73bed15cb GetProcessHeap HeapFree 37->39 38->37 41 7ff73bed1529-7ff73bed1599 call 7ff73bed1d20 38->41 39->28 46 7ff73bed159b-7ff73bed15a3 call 7ff73bed1ef0 FlushFileBuffers 41->46 47 7ff73bed160d-7ff73bed1614 call 7ff73bed1e20 41->47 53 7ff73bed15a9-7ff73bed15ac call 7ff73bed1d40 46->53 52 7ff73bed1616-7ff73bed161e call 7ff73bed1e30 47->52 47->53 52->53 57 7ff73bed15b1 53->57 57->39
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000014.00000002.2879570687.00007FF73BED1000.00000020.00000001.01000000.00000026.sdmp, Offset: 00007FF73BED0000, based on PE: true
                                                                                                                                                                • Associated: 00000014.00000002.2879499751.00007FF73BED0000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879711339.00007FF73BED4000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879811072.00007FF73BED7000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73BED9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73C8D9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_20_2_7ff73bed0000_AVGBrowserInstaller.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Heap$ByteCharMultiProcessWide$AddressEnvironmentExpandLibraryLoadProcStrings$AllocFree$BuffersFileFlushlstrlen
                                                                                                                                                                • String ID: %SYSTEMROOT%\system32\cabinet.dll$%WINDIR%\system32\cabinet.dll$C:\Windows\system32\cabinet.dll$FDICopy$FDICreate$FDIDestroy
                                                                                                                                                                • API String ID: 3409977574-864109822
                                                                                                                                                                • Opcode ID: 4fe9da1e7a045c81edf34d1c607c4bfa7a41a97613199e44181f76ade0fa5322
                                                                                                                                                                • Instruction ID: f9561ed5f8c34139af775a735324036dbfdca9ccd7686883c0b61f1d74ad49cf
                                                                                                                                                                • Opcode Fuzzy Hash: 4fe9da1e7a045c81edf34d1c607c4bfa7a41a97613199e44181f76ade0fa5322
                                                                                                                                                                • Instruction Fuzzy Hash: 30C19927B48A4269E610AB5EE844375E7A1BF99790FCC423CD9CE426B0DFBCE1459311
                                                                                                                                                                Function 00007FF73BED2F00 Relevance: 31.8, APIs: 10, Strings: 8, Instructions: 334stringCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 58 7ff73bed2f00-7ff73bed2f3b call 7ff73bed3d30 call 7ff73bed1050 call 7ff73bed10c0 65 7ff73bed2f4d-7ff73bed2f59 GetLastError 58->65 66 7ff73bed2f3d-7ff73bed2f42 58->66 69 7ff73bed2f5c-7ff73bed2f75 call 7ff73bed1080 65->69 67 7ff73bed2f44-7ff73bed2f4b 66->67 68 7ff73bed2f76-7ff73bed2fb5 GetModuleFileNameW 66->68 67->69 71 7ff73bed2fb7-7ff73bed2fc4 call 7ff73bed38c0 68->71 72 7ff73bed2fe9-7ff73bed2ff1 68->72 71->72 76 7ff73bed2fc6-7ff73bed2fe7 call 7ff73bed2d80 71->76 72->69 76->72 79 7ff73bed2ff6-7ff73bed308d call 7ff73bed1fc0 call 7ff73bed22c0 76->79 84 7ff73bed3093-7ff73bed30aa GetCurrentProcess SetProcessWorkingSetSize 79->84 85 7ff73bed3168-7ff73bed317f lstrcmpW 79->85 86 7ff73bed30b0 84->86 87 7ff73bed3181-7ff73bed31da GetCurrentProcess SetProcessWorkingSetSizeEx lstrcmpW call 7ff73bed27b0 85->87 88 7ff73bed31ec-7ff73bed3214 call 7ff73bed3690 85->88 90 7ff73bed30b2-7ff73bed30b7 86->90 95 7ff73bed31df-7ff73bed31e7 87->95 98 7ff73bed3233-7ff73bed323a 88->98 99 7ff73bed3216-7ff73bed3231 call 7ff73bed36d0 88->99 93 7ff73bed30db-7ff73bed30dd 90->93 94 7ff73bed30b9-7ff73bed30d6 call 7ff73bed2ac0 90->94 96 7ff73bed30df-7ff73bed3114 call 7ff73bed3b70 93->96 97 7ff73bed3159-7ff73bed3166 call 7ff73bed1f00 93->97 94->93 95->90 107 7ff73bed3144-7ff73bed314c call 7ff73bed3900 96->107 108 7ff73bed3116-7ff73bed313f call 7ff73bed3a60 96->108 110 7ff73bed3151-7ff73bed3154 97->110 98->69 99->98 109 7ff73bed323f-7ff73bed328f call 7ff73bed2090 99->109 107->110 108->107 115 7ff73bed3295-7ff73bed32b0 call 7ff73bed36d0 109->115 116 7ff73bed3330-7ff73bed3337 109->116 110->69 124 7ff73bed32b2-7ff73bed32ce call 7ff73bed36d0 115->124 125 7ff73bed3327 115->125 118 7ff73bed336d-7ff73bed3387 call 7ff73bed3690 116->118 119 7ff73bed3339 116->119 121 7ff73bed3343-7ff73bed3362 GetCurrentProcess SetProcessWorkingSetSize 118->121 119->121 121->86 126 7ff73bed3368 121->126 124->125 129 7ff73bed32d0-7ff73bed32eb call 7ff73bed36d0 124->129 125->116 126->118 129->125 132 7ff73bed32ed-7ff73bed3308 call 7ff73bed36d0 129->132 132->125 135 7ff73bed330a-7ff73bed3325 call 7ff73bed36d0 132->135 135->125 138 7ff73bed3389-7ff73bed33a5 call 7ff73bed36d0 135->138 138->125 141 7ff73bed33a7-7ff73bed33c2 call 7ff73bed36d0 138->141 141->125 144 7ff73bed33c8-7ff73bed33e3 call 7ff73bed36d0 141->144 144->125 147 7ff73bed33e9-7ff73bed3404 call 7ff73bed36d0 144->147 147->125 150 7ff73bed340a-7ff73bed3426 call 7ff73bed36d0 147->150 150->125 153 7ff73bed342c-7ff73bed3447 call 7ff73bed36d0 150->153 153->125 156 7ff73bed344d-7ff73bed3459 153->156 157 7ff73bed345b-7ff73bed3465 156->157 158 7ff73bed3467 156->158 159 7ff73bed348a-7ff73bed348e 157->159 160 7ff73bed346b-7ff73bed3471 158->160 163 7ff73bed3490-7ff73bed3497 159->163 164 7ff73bed3482-7ff73bed3486 159->164 161 7ff73bed3473-7ff73bed347b 160->161 162 7ff73bed34dd-7ff73bed353a call 7ff73bed2190 call 7ff73bed1a60 160->162 161->160 166 7ff73bed347d-7ff73bed3480 161->166 162->116 163->164 167 7ff73bed3499-7ff73bed349c 163->167 164->159 166->167 167->162 169 7ff73bed349e-7ff73bed34a4 167->169 171 7ff73bed34a6-7ff73bed34a9 169->171 172 7ff73bed34c8-7ff73bed34d8 call 7ff73bed36d0 169->172 171->172 175 7ff73bed34ab-7ff73bed34c6 call 7ff73bed36d0 171->175 172->162 175->162 175->172
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000014.00000002.2879570687.00007FF73BED1000.00000020.00000001.01000000.00000026.sdmp, Offset: 00007FF73BED0000, based on PE: true
                                                                                                                                                                • Associated: 00000014.00000002.2879499751.00007FF73BED0000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879711339.00007FF73BED4000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879811072.00007FF73BED7000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73BED9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73C8D9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_20_2_7ff73bed0000_AVGBrowserInstaller.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Process$Resource$CurrentSizeWorking$lstrcmp$CommandErrorFileFindFreeLastLineLoadLocalLockModuleNameSizeof
                                                                                                                                                                • String ID: " --$InstallerExtraCode1$i$new-setup-exe$setup.exe$update-setup-exe$x$y
                                                                                                                                                                • API String ID: 267043019-1120720146
                                                                                                                                                                • Opcode ID: 0089ff36d56417febc121726bee16363c885e8c6d2015cbbca92b4d4065c6674
                                                                                                                                                                • Instruction ID: a1defb8058706700f44f09392c95bebccb67d7848dd99ca2d051868d4f09ad0d
                                                                                                                                                                • Opcode Fuzzy Hash: 0089ff36d56417febc121726bee16363c885e8c6d2015cbbca92b4d4065c6674
                                                                                                                                                                • Instruction Fuzzy Hash: 69F1A067648682A9EA20EF5CE1003EAE361EF80754FC8013ADAED436E5DFBCD145D721
                                                                                                                                                                Function 00007FF73BED1A60 Relevance: 18.1, APIs: 12, Instructions: 122fileCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                • CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF73BED2775), ref: 00007FF73BED1AF4
                                                                                                                                                                • SetFileInformationByHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF73BED2775), ref: 00007FF73BED1B16
                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF73BED2775), ref: 00007FF73BED1B23
                                                                                                                                                                • SleepEx.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF73BED2775), ref: 00007FF73BED1B2D
                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF73BED2775), ref: 00007FF73BED1B35
                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF73BED2775), ref: 00007FF73BED1B41
                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF73BED2775), ref: 00007FF73BED1B46
                                                                                                                                                                • CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF73BED2775), ref: 00007FF73BED1BA9
                                                                                                                                                                • GetFileInformationByHandleEx.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF73BED1BDA
                                                                                                                                                                • SetFileInformationByHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF73BED1C09
                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF73BED1C15
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000014.00000002.2879570687.00007FF73BED1000.00000020.00000001.01000000.00000026.sdmp, Offset: 00007FF73BED0000, based on PE: true
                                                                                                                                                                • Associated: 00000014.00000002.2879499751.00007FF73BED0000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879711339.00007FF73BED4000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879811072.00007FF73BED7000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73BED9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73C8D9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_20_2_7ff73bed0000_AVGBrowserInstaller.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Handle$File$CloseInformation$CreateErrorLast$Sleep
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1461999944-0
                                                                                                                                                                • Opcode ID: 2bc0746f84eeb63f3c972e3b14a0ed96cbdbb9a7e90dd3110ee113912ce8a8f0
                                                                                                                                                                • Instruction ID: 5ba8534be411c5322c8d777e69934175881f830aa49a04738524ee7d1897eaf1
                                                                                                                                                                • Opcode Fuzzy Hash: 2bc0746f84eeb63f3c972e3b14a0ed96cbdbb9a7e90dd3110ee113912ce8a8f0
                                                                                                                                                                • Instruction Fuzzy Hash: 08410327B885425AE720AB1EB800736A2A0BF847A4FCC4238EDDD067F0EFBDD5459311
                                                                                                                                                                Function 00007FF73BED11C0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 80stringCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000014.00000002.2879570687.00007FF73BED1000.00000020.00000001.01000000.00000026.sdmp, Offset: 00007FF73BED0000, based on PE: true
                                                                                                                                                                • Associated: 00000014.00000002.2879499751.00007FF73BED0000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879711339.00007FF73BED4000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879811072.00007FF73BED7000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73BED9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73C8D9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_20_2_7ff73bed0000_AVGBrowserInstaller.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: lstrcmpi$ArgvCommandEnvironmentLineVariable
                                                                                                                                                                • String ID: --chrome-frame$--cleanup$--system-level$AVGUpdateIsMachine
                                                                                                                                                                • API String ID: 310715562-2612680089
                                                                                                                                                                • Opcode ID: 02780136ecd89e51cafb92500ff057bda20c74c634e6f4a595168d8714a1a7c3
                                                                                                                                                                • Instruction ID: 79daa0fd63406ce7b2b1062d8069b896122b66ca53ddba144dfab6143042742a
                                                                                                                                                                • Opcode Fuzzy Hash: 02780136ecd89e51cafb92500ff057bda20c74c634e6f4a595168d8714a1a7c3
                                                                                                                                                                • Instruction Fuzzy Hash: 7A21B82BB45642A8EB219B1EF841269E760BB55BD4FCC8035CDCD873A4DE7DD181E321
                                                                                                                                                                Function 00007FF73BED10C0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 72COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000014.00000002.2879570687.00007FF73BED1000.00000020.00000001.01000000.00000026.sdmp, Offset: 00007FF73BED0000, based on PE: true
                                                                                                                                                                • Associated: 00000014.00000002.2879499751.00007FF73BED0000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879711339.00007FF73BED4000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879811072.00007FF73BED7000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73BED9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73C8D9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_20_2_7ff73bed0000_AVGBrowserInstaller.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Resource$CommandFindFreeLineLoadLocalLockSizeof
                                                                                                                                                                • String ID: ChromeInstallerCleanup$Software\AVG\Browser${48F69C39-1356-4A7B-A899-70E3539D4982}
                                                                                                                                                                • API String ID: 1366880580-631935749
                                                                                                                                                                • Opcode ID: ab92969b8a9114797dfbaf68cc9680e89028152b20e622ba42456c8f4729e385
                                                                                                                                                                • Instruction ID: 5b50f000cb7df1126e0c3624442fec556d0541c50e59090dccad1c80bec27a95
                                                                                                                                                                • Opcode Fuzzy Hash: ab92969b8a9114797dfbaf68cc9680e89028152b20e622ba42456c8f4729e385
                                                                                                                                                                • Instruction Fuzzy Hash: A421692774575259EE10AB1DA904369E3A0AF55BC0FCC8138CACE47BA1EFBDE145D311
                                                                                                                                                                Function 00007FF73BED2190 Relevance: 12.1, APIs: 8, Instructions: 78processsynchronizationCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000014.00000002.2879570687.00007FF73BED1000.00000020.00000001.01000000.00000026.sdmp, Offset: 00007FF73BED0000, based on PE: true
                                                                                                                                                                • Associated: 00000014.00000002.2879499751.00007FF73BED0000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879711339.00007FF73BED4000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879811072.00007FF73BED7000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73BED9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73C8D9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_20_2_7ff73bed0000_AVGBrowserInstaller.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseErrorHandleLastProcess$AttributesCodeCreateExitFileObjectSingleWait
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1236864362-0
                                                                                                                                                                • Opcode ID: 8351b14297eabcbe837245b116425a508a20d85b7f1011e6608db8d55c8c4f5d
                                                                                                                                                                • Instruction ID: c60cc08485f43d55aca371e15bc6881ab889cbc7d15ed5afd86f78e027cebc97
                                                                                                                                                                • Opcode Fuzzy Hash: 8351b14297eabcbe837245b116425a508a20d85b7f1011e6608db8d55c8c4f5d
                                                                                                                                                                • Instruction Fuzzy Hash: 1E314C73948A819AE7609F1DF844769F7B0EB94750F888138EAC942A64EF7CD085D710
                                                                                                                                                                Function 00007FF73BED2B70 Relevance: 12.1, APIs: 8, Instructions: 63memoryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000014.00000002.2879570687.00007FF73BED1000.00000020.00000001.01000000.00000026.sdmp, Offset: 00007FF73BED0000, based on PE: true
                                                                                                                                                                • Associated: 00000014.00000002.2879499751.00007FF73BED0000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879711339.00007FF73BED4000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879811072.00007FF73BED7000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73BED9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73C8D9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_20_2_7ff73bed0000_AVGBrowserInstaller.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Token$InformationLocalProcess$AllocCloseCurrentErrorFreeHandleLastOpen
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3439255530-0
                                                                                                                                                                • Opcode ID: 2eadaef680c91326a613d77946fde9df6a74bd8a20042649d6a2e0ec0ab4912c
                                                                                                                                                                • Instruction ID: 6396e5c3c0836f8f06d70c77c5b00d5d3d209ad873d73b7352731c1f1f9841e4
                                                                                                                                                                • Opcode Fuzzy Hash: 2eadaef680c91326a613d77946fde9df6a74bd8a20042649d6a2e0ec0ab4912c
                                                                                                                                                                • Instruction Fuzzy Hash: 37214723A4D5429AF750AB2EE81476AE360AFD4B40FD94138DECE43A74DEBCD446D710
                                                                                                                                                                Function 00007FF73BED2D80 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 103COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000014.00000002.2879570687.00007FF73BED1000.00000020.00000001.01000000.00000026.sdmp, Offset: 00007FF73BED0000, based on PE: true
                                                                                                                                                                • Associated: 00000014.00000002.2879499751.00007FF73BED0000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879711339.00007FF73BED4000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879811072.00007FF73BED7000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73BED9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73C8D9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_20_2_7ff73bed0000_AVGBrowserInstaller.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateDirectoryErrorFreeFunction036LastLocalSystem
                                                                                                                                                                • String ID: .tmp$CR_
                                                                                                                                                                • API String ID: 1732257400-4069842749
                                                                                                                                                                • Opcode ID: cedaa09122b866b700c23d725d11211cb0a10d8a0670603acc118ff6f562a14a
                                                                                                                                                                • Instruction ID: 84b38374475769e706bce902c21b1e6f900e3034cbceece89b0f25ec63627218
                                                                                                                                                                • Opcode Fuzzy Hash: cedaa09122b866b700c23d725d11211cb0a10d8a0670603acc118ff6f562a14a
                                                                                                                                                                • Instruction Fuzzy Hash: 9E31A263A4864269FA10BB1DE9407B9D751AF817C0FD88139DECE077A1DFBCD585E220
                                                                                                                                                                Function 00007FF73BED22C0 Relevance: 9.3, APIs: 4, Strings: 2, Instructions: 292stringCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 282 7ff73bed22c0-7ff73bed236b call 7ff73bed1c50 285 7ff73bed236d-7ff73bed2385 call 7ff73bed3660 282->285 286 7ff73bed23aa-7ff73bed23ba call 7ff73bed3660 282->286 293 7ff73bed2388-7ff73bed238f 285->293 291 7ff73bed23e0-7ff73bed23f8 call 7ff73bed3660 286->291 292 7ff73bed23bc-7ff73bed23c2 286->292 300 7ff73bed241e-7ff73bed2468 call 7ff73bed1c50 291->300 301 7ff73bed23fa-7ff73bed2400 291->301 292->291 294 7ff73bed23c4-7ff73bed23da call 7ff73bed3690 292->294 296 7ff73bed2393-7ff73bed23a9 293->296 294->291 302 7ff73bed24a0 294->302 300->285 308 7ff73bed246e-7ff73bed247e call 7ff73bed3660 300->308 301->300 303 7ff73bed2402-7ff73bed2418 call 7ff73bed3690 301->303 305 7ff73bed24a6-7ff73bed24ab 302->305 303->300 311 7ff73bed24b0-7ff73bed24b6 303->311 305->293 313 7ff73bed2480-7ff73bed2486 308->313 314 7ff73bed24b8-7ff73bed24d0 call 7ff73bed3660 308->314 311->305 313->314 315 7ff73bed2488-7ff73bed249e call 7ff73bed3690 313->315 320 7ff73bed24f2-7ff73bed253c call 7ff73bed1c50 314->320 321 7ff73bed24d2-7ff73bed24d8 314->321 315->302 315->314 320->285 327 7ff73bed2542-7ff73bed2552 call 7ff73bed3660 320->327 321->320 323 7ff73bed24da-7ff73bed24f0 call 7ff73bed3690 321->323 323->311 323->320 330 7ff73bed2554-7ff73bed255a 327->330 331 7ff73bed2578-7ff73bed2590 call 7ff73bed3660 327->331 330->331 332 7ff73bed255c-7ff73bed2572 call 7ff73bed3690 330->332 337 7ff73bed25b6-7ff73bed25bc 331->337 338 7ff73bed2592-7ff73bed2598 331->338 332->302 332->331 339 7ff73bed2604 337->339 340 7ff73bed25be-7ff73bed25c4 337->340 338->337 341 7ff73bed259a-7ff73bed25b0 call 7ff73bed3690 338->341 345 7ff73bed260e-7ff73bed2616 339->345 343 7ff73bed25c6-7ff73bed25e5 call 7ff73bed3690 340->343 344 7ff73bed25f8-7ff73bed2602 340->344 341->311 341->337 349 7ff73bed261b-7ff73bed2632 call 7ff73bed36d0 343->349 350 7ff73bed25e7-7ff73bed25f3 343->350 344->345 345->296 349->350 353 7ff73bed2634-7ff73bed2643 call 7ff73bed3c10 349->353 350->296 356 7ff73bed2645-7ff73bed2650 GetLastError 353->356 357 7ff73bed265e-7ff73bed2675 call 7ff73bed3690 353->357 358 7ff73bed2656-7ff73bed2659 356->358 357->350 361 7ff73bed267b-7ff73bed26af lstrcmpW call 7ff73bed36d0 357->361 358->296 361->350 364 7ff73bed26b5-7ff73bed26c4 call 7ff73bed3c10 361->364 367 7ff73bed26c6-7ff73bed26d7 GetLastError 364->367 368 7ff73bed26dc-7ff73bed26f3 lstrcmpW 364->368 367->358 369 7ff73bed26f5-7ff73bed26f7 368->369 370 7ff73bed26fc-7ff73bed271e call 7ff73bed3690 368->370 369->345 370->350 373 7ff73bed2724-7ff73bed273c call 7ff73bed36d0 370->373 373->350 376 7ff73bed2742-7ff73bed2770 call 7ff73bed12c0 call 7ff73bed1a60 373->376 380 7ff73bed2775-7ff73bed277a 376->380 381 7ff73bed277c 380->381 382 7ff73bed277e-7ff73bed279f call 7ff73bed3690 380->382 381->382 382->345
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000014.00000002.2879570687.00007FF73BED1000.00000020.00000001.01000000.00000026.sdmp, Offset: 00007FF73BED0000, based on PE: true
                                                                                                                                                                • Associated: 00000014.00000002.2879499751.00007FF73BED0000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879711339.00007FF73BED4000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879811072.00007FF73BED7000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73BED9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73C8D9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_20_2_7ff73bed0000_AVGBrowserInstaller.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLastlstrcmp$EnumNamesResource
                                                                                                                                                                • String ID: p$setup.exe
                                                                                                                                                                • API String ID: 226634954-3974311440
                                                                                                                                                                • Opcode ID: b14f97fcc36da269f24d1d39e5e3dd10ca0960190398157546731fc3b9ecd8df
                                                                                                                                                                • Instruction ID: 54be92910bfdf8027bc9a21f8982949cfb158622a689348109297821e2d37fe2
                                                                                                                                                                • Opcode Fuzzy Hash: b14f97fcc36da269f24d1d39e5e3dd10ca0960190398157546731fc3b9ecd8df
                                                                                                                                                                • Instruction Fuzzy Hash: 9ED19123A4C742A9EA10EB1DE4103AAE360EB85784FD84039DECD477A5DFBDE542E750
                                                                                                                                                                Function 00007FF73BED2C50 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                • D:PAI(A;;FA;;;BA)(A;OIIOCI;GA;;;BA)(A;;FA;;;SY)(A;OIIOCI;GA;;;SY)(A;OIIOCI;GA;;;CO)(A;;FA;;;, xrefs: 00007FF73BED2CF9
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000014.00000002.2879570687.00007FF73BED1000.00000020.00000001.01000000.00000026.sdmp, Offset: 00007FF73BED0000, based on PE: true
                                                                                                                                                                • Associated: 00000014.00000002.2879499751.00007FF73BED0000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879711339.00007FF73BED4000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879811072.00007FF73BED7000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73BED9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73C8D9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_20_2_7ff73bed0000_AVGBrowserInstaller.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: InformationProcessTokenVolume$CloseCurrentErrorFreeHandleLastLocalNameOpenPath
                                                                                                                                                                • String ID: D:PAI(A;;FA;;;BA)(A;OIIOCI;GA;;;BA)(A;;FA;;;SY)(A;OIIOCI;GA;;;SY)(A;OIIOCI;GA;;;CO)(A;;FA;;;
                                                                                                                                                                • API String ID: 3974508999-3878039831
                                                                                                                                                                • Opcode ID: 8b3d5514f77ae5da6805592f71471ee7e62a37f4e432f8567dcaec41148646df
                                                                                                                                                                • Instruction ID: fb533eb25a39d22aba18de966efe8cf26981b20b7d8ed5810fbffa7d825c68b5
                                                                                                                                                                • Opcode Fuzzy Hash: 8b3d5514f77ae5da6805592f71471ee7e62a37f4e432f8567dcaec41148646df
                                                                                                                                                                • Instruction Fuzzy Hash: F2316333A486419AE750AF2CE4043AAA360EFD6744FD84039DACD87AB4DFBDD50AD711
                                                                                                                                                                Function 00007FF73BED3B70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47registryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000014.00000002.2879570687.00007FF73BED1000.00000020.00000001.01000000.00000026.sdmp, Offset: 00007FF73BED0000, based on PE: true
                                                                                                                                                                • Associated: 00000014.00000002.2879499751.00007FF73BED0000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879711339.00007FF73BED4000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879811072.00007FF73BED7000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73BED9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73C8D9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_20_2_7ff73bed0000_AVGBrowserInstaller.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseOpen
                                                                                                                                                                • String ID: Software\AVG\Browser\Update\ClientState\
                                                                                                                                                                • API String ID: 47109696-1203574686
                                                                                                                                                                • Opcode ID: 210a82894b2d023621153f6342bf16732ea6578f8add68fffe138d9bc364e3ae
                                                                                                                                                                • Instruction ID: 836e4f027fb15184639d73af214034d10ca3ea8b7dc79e274e477e793987dc1f
                                                                                                                                                                • Opcode Fuzzy Hash: 210a82894b2d023621153f6342bf16732ea6578f8add68fffe138d9bc364e3ae
                                                                                                                                                                • Instruction Fuzzy Hash: B6014523A1964156F760EF9DF8403BAA761AF84780FC84235DE9C477A1EE7CC545C350
                                                                                                                                                                Function 00007FF73BED3C10 Relevance: 4.6, APIs: 3, Instructions: 73fileCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000014.00000002.2879570687.00007FF73BED1000.00000020.00000001.01000000.00000026.sdmp, Offset: 00007FF73BED0000, based on PE: true
                                                                                                                                                                • Associated: 00000014.00000002.2879499751.00007FF73BED0000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879711339.00007FF73BED4000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879811072.00007FF73BED7000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73BED9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73C8D9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_20_2_7ff73bed0000_AVGBrowserInstaller.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorFileLast$CloseCreateHandleWrite
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4031202350-0
                                                                                                                                                                • Opcode ID: e957e32d74b0a2fdc6080c5b0a24bfbadcbc13d7dc88f076a4c57564784524ac
                                                                                                                                                                • Instruction ID: 7f97a256afe915601704fb5bcf6ff3acdf4c687c61167bd20d973551314d8643
                                                                                                                                                                • Opcode Fuzzy Hash: e957e32d74b0a2fdc6080c5b0a24bfbadcbc13d7dc88f076a4c57564784524ac
                                                                                                                                                                • Instruction Fuzzy Hash: 5321A427B5845169EA10BB1EA9107BAD250BF44BC8FCC0039EE9E4B791DF7CD5069361
                                                                                                                                                                Function 00007FF73BED3AA0 Relevance: 4.6, APIs: 3, Instructions: 60registryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 509 7ff73bed3aa0-7ff73bed3ad3 RegOpenKeyExW 510 7ff73bed3ad5-7ff73bed3add 509->510 511 7ff73bed3af1-7ff73bed3b2f RegQueryValueExW 509->511 512 7ff73bed3ae5-7ff73bed3af0 510->512 513 7ff73bed3adf RegCloseKey 510->513 511->510 514 7ff73bed3b31-7ff73bed3b36 511->514 513->512 514->510 515 7ff73bed3b38-7ff73bed3b40 514->515 516 7ff73bed3b42-7ff73bed3b4d 515->516 517 7ff73bed3b59 515->517 518 7ff73bed3b5e-7ff73bed3b61 516->518 519 7ff73bed3b4f-7ff73bed3b54 516->519 517->518 518->510 520 7ff73bed3b66-7ff73bed3b68 519->520 521 7ff73bed3b56 519->521 520->510 521->517
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000014.00000002.2879570687.00007FF73BED1000.00000020.00000001.01000000.00000026.sdmp, Offset: 00007FF73BED0000, based on PE: true
                                                                                                                                                                • Associated: 00000014.00000002.2879499751.00007FF73BED0000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879711339.00007FF73BED4000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879811072.00007FF73BED7000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73BED9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73C8D9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_20_2_7ff73bed0000_AVGBrowserInstaller.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseOpenQueryValue
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3677997916-0
                                                                                                                                                                • Opcode ID: 5d696903eef99be96c3fed19f4970a404a720d2e0c9b52a93c59297ce0b063b1
                                                                                                                                                                • Instruction ID: 57320e335408741ab2c593f6ae29e1d7918bf25f6bc6f95c4889f72c103d1106
                                                                                                                                                                • Opcode Fuzzy Hash: 5d696903eef99be96c3fed19f4970a404a720d2e0c9b52a93c59297ce0b063b1
                                                                                                                                                                • Instruction Fuzzy Hash: B2219F33B586419AEB209F1EE84076AE2B4EB84751FC94139EACD43AA0DFBDD5419B10
                                                                                                                                                                Function 00007FF73BED1000 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 8COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 522 7ff73bed1000-7ff73bed101b call 7ff73bed2f00 ExitProcess
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000014.00000002.2879570687.00007FF73BED1000.00000020.00000001.01000000.00000026.sdmp, Offset: 00007FF73BED0000, based on PE: true
                                                                                                                                                                • Associated: 00000014.00000002.2879499751.00007FF73BED0000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879711339.00007FF73BED4000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879811072.00007FF73BED7000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73BED9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73C8D9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_20_2_7ff73bed0000_AVGBrowserInstaller.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExitProcess
                                                                                                                                                                • String ID: MZx
                                                                                                                                                                • API String ID: 621844428-2575928145
                                                                                                                                                                • Opcode ID: cfe631379b77c2ad76c766403549bead21deb199acd83f7a1c97fe6e0a56ee78
                                                                                                                                                                • Instruction ID: 2519fb47b1909d40e3202c5243cdf2eab2975468bf96ebd6a363db6e681a599c
                                                                                                                                                                • Opcode Fuzzy Hash: cfe631379b77c2ad76c766403549bead21deb199acd83f7a1c97fe6e0a56ee78
                                                                                                                                                                • Instruction Fuzzy Hash: E3C01226A58412A6E614BB1CE414068E321EF40744FC88438D5CE17639DE5CA607DB10
                                                                                                                                                                Function 00007FF73BED1D80 Relevance: 3.0, APIs: 2, Instructions: 36fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000014.00000002.2879570687.00007FF73BED1000.00000020.00000001.01000000.00000026.sdmp, Offset: 00007FF73BED0000, based on PE: true
                                                                                                                                                                • Associated: 00000014.00000002.2879499751.00007FF73BED0000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879711339.00007FF73BED4000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879811072.00007FF73BED7000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73BED9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73C8D9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_20_2_7ff73bed0000_AVGBrowserInstaller.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseCreateFileHandle
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3498533004-0
                                                                                                                                                                • Opcode ID: 43ecf7887410a3cdc2d86b814cf285b5cb129828e176ace82e3ae0111fc38876
                                                                                                                                                                • Instruction ID: ac22981da749ede63ea731935dd26ee76985f51fddd31d31ef929d7d3ea01b7d
                                                                                                                                                                • Opcode Fuzzy Hash: 43ecf7887410a3cdc2d86b814cf285b5cb129828e176ace82e3ae0111fc38876
                                                                                                                                                                • Instruction Fuzzy Hash: 6F01D63365464145E6609B2DF8583A6A250EB917B4F984338DFFA0BBE4DFFD84839710
                                                                                                                                                                Function 00007FF73BED3A10 Relevance: 3.0, APIs: 2, Instructions: 23registrystringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000014.00000002.2879570687.00007FF73BED1000.00000020.00000001.01000000.00000026.sdmp, Offset: 00007FF73BED0000, based on PE: true
                                                                                                                                                                • Associated: 00000014.00000002.2879499751.00007FF73BED0000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879711339.00007FF73BED4000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879811072.00007FF73BED7000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73BED9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73C8D9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_20_2_7ff73bed0000_AVGBrowserInstaller.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Valuelstrlen
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 799288031-0
                                                                                                                                                                • Opcode ID: 7ff8c900bcc410150cfb2148f23c027fe38294960bd86cbbe4585ad37c06a698
                                                                                                                                                                • Instruction ID: cd57924a3b02e598ecebb5ad3748c28bbae994dbe023558c8a525159561af625
                                                                                                                                                                • Opcode Fuzzy Hash: 7ff8c900bcc410150cfb2148f23c027fe38294960bd86cbbe4585ad37c06a698
                                                                                                                                                                • Instruction Fuzzy Hash: 47E0D83771455189E710AB2AF804B59E720A7E8FD4F4841309D8C43B34CA2CC14A8B00
                                                                                                                                                                Function 00007FF73BED3930 Relevance: 1.5, APIs: 1, Instructions: 39registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000014.00000002.2879570687.00007FF73BED1000.00000020.00000001.01000000.00000026.sdmp, Offset: 00007FF73BED0000, based on PE: true
                                                                                                                                                                • Associated: 00000014.00000002.2879499751.00007FF73BED0000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879711339.00007FF73BED4000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879811072.00007FF73BED7000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73BED9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73C8D9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_20_2_7ff73bed0000_AVGBrowserInstaller.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: QueryValue
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3660427363-0
                                                                                                                                                                • Opcode ID: a4f90c46a4d2d39a367206f6bfe51a569e5296385270251a3ebb66db762dc31c
                                                                                                                                                                • Instruction ID: 4bd599c9c016400f2db7fc7b1ada380054b29b97ec2f185ab7e844f516880a9b
                                                                                                                                                                • Opcode Fuzzy Hash: a4f90c46a4d2d39a367206f6bfe51a569e5296385270251a3ebb66db762dc31c
                                                                                                                                                                • Instruction Fuzzy Hash: B001D433A5A54196E7209B1CE10176DA3A0EB90750FD84239EBCA42AE8DFBCD541DA10
                                                                                                                                                                Function 00007FF73BED3A60 Relevance: 1.5, APIs: 1, Instructions: 12registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000014.00000002.2879570687.00007FF73BED1000.00000020.00000001.01000000.00000026.sdmp, Offset: 00007FF73BED0000, based on PE: true
                                                                                                                                                                • Associated: 00000014.00000002.2879499751.00007FF73BED0000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879711339.00007FF73BED4000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879811072.00007FF73BED7000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73BED9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73C8D9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_20_2_7ff73bed0000_AVGBrowserInstaller.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Value
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3702945584-0
                                                                                                                                                                • Opcode ID: f121e13d88844f69a037b5d0c6495794bc2f2e0e0c3fadbb19a8f44403a942a3
                                                                                                                                                                • Instruction ID: 739bbe977306089ec8527777ef1b5d9efa11108656c05355e9a95f9f0ce22f43
                                                                                                                                                                • Opcode Fuzzy Hash: f121e13d88844f69a037b5d0c6495794bc2f2e0e0c3fadbb19a8f44403a942a3
                                                                                                                                                                • Instruction Fuzzy Hash: 33D05E77615A808AD360AF14E84570D7760F398B88FD06010EB8C03B20CB3CC125CF04
                                                                                                                                                                Function 00007FF73BED1D40 Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • FindCloseChangeNotification.KERNELBASE(?,?,00000000,00007FF73BED3CEF), ref: 00007FF73BED1D60
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000014.00000002.2879570687.00007FF73BED1000.00000020.00000001.01000000.00000026.sdmp, Offset: 00007FF73BED0000, based on PE: true
                                                                                                                                                                • Associated: 00000014.00000002.2879499751.00007FF73BED0000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879711339.00007FF73BED4000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879811072.00007FF73BED7000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73BED9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                • Associated: 00000014.00000002.2879984372.00007FF73C8D9000.00000002.00000001.01000000.00000026.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_20_2_7ff73bed0000_AVGBrowserInstaller.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ChangeCloseFindNotification
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2591292051-0
                                                                                                                                                                • Opcode ID: 34ac77859a5977fa8503b67ef728e2245d26bbb5b657dce9f0d8ba92aa1fb87e
                                                                                                                                                                • Instruction ID: 3e5cce94a39cf3826ff549e998c1b30cf19dc6f6794f9a3781e79aef8baed7f5
                                                                                                                                                                • Opcode Fuzzy Hash: 34ac77859a5977fa8503b67ef728e2245d26bbb5b657dce9f0d8ba92aa1fb87e
                                                                                                                                                                • Instruction Fuzzy Hash: 20D0A733A4494681D3646B6DF4881B46220EF54730F994330D6FD063F09FE844C34300

                                                                                                                                                                Executed Functions

                                                                                                                                                                Function 00007FF60169E6B0 Relevance: 40.2, APIs: 32, Instructions: 229memoryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 0 7ff60169e6b0-7ff60169e6c2 VirtualFree 1 7ff60169e6c4-7ff60169e6c8 0->1 2 7ff60169e6c9-7ff60169e6d1 GetLastError 0->2 2->1 3 7ff60169e6d3-7ff60169e6f7 2->3 4 7ff60169e733-7ff60169e736 3->4 5 7ff60169e6f9-7ff60169e71d VirtualAlloc 3->5 8 7ff60169ea18-7ff60169ea1b 4->8 9 7ff60169e73c-7ff60169e749 4->9 6 7ff60169e71f-7ff60169e722 5->6 7 7ff60169e724-7ff60169e732 5->7 6->7 10 7ff60169e755-7ff60169e764 GetLastError 6->10 9->10 11 7ff60169e776-7ff60169e799 Sleep VirtualAlloc 10->11 12 7ff60169e766-7ff60169e76b 10->12 11->7 14 7ff60169e79b-7ff60169e7aa GetLastError 11->14 12->11 13 7ff60169e76d-7ff60169e770 12->13 13->11 15 7ff60169e772-7ff60169e774 13->15 16 7ff60169e7b8-7ff60169e7db Sleep VirtualAlloc 14->16 17 7ff60169e7ac-7ff60169e7b1 14->17 15->7 16->7 19 7ff60169e7e1-7ff60169e7f0 GetLastError 16->19 17->16 18 7ff60169e7b3-7ff60169e7b6 17->18 18->15 18->16 20 7ff60169e802-7ff60169e825 Sleep VirtualAlloc 19->20 21 7ff60169e7f2-7ff60169e7f7 19->21 20->7 23 7ff60169e82b-7ff60169e83a GetLastError 20->23 21->20 22 7ff60169e7f9-7ff60169e7fc 21->22 22->15 22->20 24 7ff60169e84c-7ff60169e86f Sleep VirtualAlloc 23->24 25 7ff60169e83c-7ff60169e841 23->25 24->7 27 7ff60169e875-7ff60169e884 GetLastError 24->27 25->24 26 7ff60169e843-7ff60169e846 25->26 26->15 26->24 28 7ff60169e896-7ff60169e8b9 Sleep VirtualAlloc 27->28 29 7ff60169e886-7ff60169e88b 27->29 28->7 31 7ff60169e8bf-7ff60169e8ce GetLastError 28->31 29->28 30 7ff60169e88d-7ff60169e890 29->30 30->15 30->28 32 7ff60169e8e0-7ff60169e903 Sleep VirtualAlloc 31->32 33 7ff60169e8d0-7ff60169e8d5 31->33 32->7 35 7ff60169e909-7ff60169e918 GetLastError 32->35 33->32 34 7ff60169e8d7-7ff60169e8da 33->34 34->15 34->32 36 7ff60169e92a-7ff60169e94d Sleep VirtualAlloc 35->36 37 7ff60169e91a-7ff60169e91f 35->37 36->7 39 7ff60169e953-7ff60169e962 GetLastError 36->39 37->36 38 7ff60169e921-7ff60169e924 37->38 38->15 38->36 40 7ff60169e974-7ff60169e997 Sleep VirtualAlloc 39->40 41 7ff60169e964-7ff60169e969 39->41 40->7 43 7ff60169e99d-7ff60169e9ac GetLastError 40->43 41->40 42 7ff60169e96b-7ff60169e96e 41->42 42->15 42->40 44 7ff60169e9be-7ff60169e9e1 Sleep VirtualAlloc 43->44 45 7ff60169e9ae-7ff60169e9b3 43->45 44->7 47 7ff60169e9e7-7ff60169e9f6 GetLastError 44->47 45->44 46 7ff60169e9b5-7ff60169e9b8 45->46 46->15 46->44 48 7ff60169ea08-7ff60169ea13 Sleep 47->48 49 7ff60169e9f8-7ff60169e9fd 47->49 49->48 50 7ff60169e9ff-7ff60169ea02 49->50 50->15 50->48
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000017.00000002.2873167826.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000017.00000002.2873135029.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873586684.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873641021.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873669846.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873708103.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873735112.00007FF601827000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601828000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874013552.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874044593.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874077418.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874105060.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874134297.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_23_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Virtual$AllocErrorFreeLast
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3335258512-0
                                                                                                                                                                • Opcode ID: 96171a4be346dcee1bba5a0798965b96ccbd870a44ce8d95c8ce96f34643c743
                                                                                                                                                                • Instruction ID: 483cee3e563fa248f87df54555cc89f9841ab3c61e4138d5e8245a7ba579b71a
                                                                                                                                                                • Opcode Fuzzy Hash: 96171a4be346dcee1bba5a0798965b96ccbd870a44ce8d95c8ce96f34643c743
                                                                                                                                                                • Instruction Fuzzy Hash: B981A430F2A50743FF6587119CA9B7D2249EF56BC6F340439DA0EC67E0DE2E65849712
                                                                                                                                                                Function 00007FF601636140 Relevance: 37.7, APIs: 30, Instructions: 194sleepmemoryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 51 7ff601636140-7ff601636166 VirtualAlloc 52 7ff601636168-7ff601636170 51->52 53 7ff60163617c-7ff601636186 51->53 52->53 54 7ff601636172-7ff601636175 52->54 54->53 55 7ff601636177-7ff60163617a 54->55 55->53 56 7ff601636187-7ff601636196 GetLastError 55->56 57 7ff6016361a8-7ff6016361c8 Sleep VirtualAlloc 56->57 58 7ff601636198-7ff60163619d 56->58 57->53 60 7ff6016361ca-7ff6016361d9 GetLastError 57->60 58->57 59 7ff60163619f-7ff6016361a2 58->59 59->57 61 7ff6016361a4-7ff6016361a6 59->61 62 7ff6016361e7-7ff601636207 Sleep VirtualAlloc 60->62 63 7ff6016361db-7ff6016361e0 60->63 61->53 62->53 65 7ff60163620d-7ff60163621c GetLastError 62->65 63->62 64 7ff6016361e2-7ff6016361e5 63->64 64->61 64->62 66 7ff60163622e-7ff60163624e Sleep VirtualAlloc 65->66 67 7ff60163621e-7ff601636223 65->67 66->53 69 7ff601636254-7ff601636263 GetLastError 66->69 67->66 68 7ff601636225-7ff601636228 67->68 68->61 68->66 70 7ff601636275-7ff601636295 Sleep VirtualAlloc 69->70 71 7ff601636265-7ff60163626a 69->71 70->53 73 7ff60163629b-7ff6016362aa GetLastError 70->73 71->70 72 7ff60163626c-7ff60163626f 71->72 72->61 72->70 74 7ff6016362bc-7ff6016362dc Sleep VirtualAlloc 73->74 75 7ff6016362ac-7ff6016362b1 73->75 74->53 77 7ff6016362e2-7ff6016362f1 GetLastError 74->77 75->74 76 7ff6016362b3-7ff6016362b6 75->76 76->61 76->74 78 7ff601636303-7ff601636323 Sleep VirtualAlloc 77->78 79 7ff6016362f3-7ff6016362f8 77->79 78->53 81 7ff601636329-7ff601636338 GetLastError 78->81 79->78 80 7ff6016362fa-7ff6016362fd 79->80 80->61 80->78 82 7ff60163634a-7ff60163636a Sleep VirtualAlloc 81->82 83 7ff60163633a-7ff60163633f 81->83 82->53 85 7ff601636370-7ff60163637f GetLastError 82->85 83->82 84 7ff601636341-7ff601636344 83->84 84->61 84->82 86 7ff601636391-7ff6016363b1 Sleep VirtualAlloc 85->86 87 7ff601636381-7ff601636386 85->87 86->53 89 7ff6016363b7-7ff6016363c6 GetLastError 86->89 87->86 88 7ff601636388-7ff60163638b 87->88 88->61 88->86 90 7ff6016363d8-7ff6016363f8 Sleep VirtualAlloc 89->90 91 7ff6016363c8-7ff6016363cd 89->91 90->53 93 7ff6016363fe-7ff60163640d GetLastError 90->93 91->90 92 7ff6016363cf-7ff6016363d2 91->92 92->61 92->90 94 7ff60163641f-7ff60163642a Sleep 93->94 95 7ff60163640f-7ff601636414 93->95 95->94 96 7ff601636416-7ff601636419 95->96 96->61 96->94
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000017.00000002.2873167826.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000017.00000002.2873135029.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873586684.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873641021.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873669846.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873708103.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873735112.00007FF601827000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601828000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874013552.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874044593.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874077418.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874105060.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874134297.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_23_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocErrorLastSleepVirtual
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2288223010-0
                                                                                                                                                                • Opcode ID: 1abe398b5e4067dad80377d2405b38ad508f29916b91bb9ae62f50e1799e505e
                                                                                                                                                                • Instruction ID: eb4c2151cbcbd6fd6739a0bdc2c1cd3f3d2c90efd36acb1d1da2a48015c4a112
                                                                                                                                                                • Opcode Fuzzy Hash: 1abe398b5e4067dad80377d2405b38ad508f29916b91bb9ae62f50e1799e505e
                                                                                                                                                                • Instruction Fuzzy Hash: D471C830F2A90752FF6A4715DC59F396251AF97B86F340438DD0EC26E1CE3D6B8AA211
                                                                                                                                                                Function 00007FF6016D8B3C Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,00007FF6016C5D7D,?,?,?,?,00007FF6016D800A,?,?,00000000,00007FF6016B0136,?,?,?), ref: 00007FF6016D8B4B
                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,?,00007FF6016C5D7D,?,?,?,?,00007FF6016D800A,?,?,00000000,00007FF6016B0136,?,?,?), ref: 00007FF6016D8B81
                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,?,00007FF6016C5D7D,?,?,?,?,00007FF6016D800A,?,?,00000000,00007FF6016B0136,?,?,?), ref: 00007FF6016D8BAE
                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,?,00007FF6016C5D7D,?,?,?,?,00007FF6016D800A,?,?,00000000,00007FF6016B0136,?,?,?), ref: 00007FF6016D8BBF
                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,?,00007FF6016C5D7D,?,?,?,?,00007FF6016D800A,?,?,00000000,00007FF6016B0136,?,?,?), ref: 00007FF6016D8BD0
                                                                                                                                                                • SetLastError.KERNEL32(?,?,?,00007FF6016C5D7D,?,?,?,?,00007FF6016D800A,?,?,00000000,00007FF6016B0136,?,?,?), ref: 00007FF6016D8BEB
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000017.00000002.2873167826.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000017.00000002.2873135029.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873586684.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873641021.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873669846.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873708103.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873735112.00007FF601827000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601828000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874013552.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874044593.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874077418.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874105060.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874134297.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_23_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Value$ErrorLast
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2506987500-0
                                                                                                                                                                • Opcode ID: b1f4a4ba26ec96e6bb88116b2b015f126d58dffa6376e7bf34eaa6df3d4e115c
                                                                                                                                                                • Instruction ID: 027fdc1de553de053e38980be6963603d59ac909254af25a5fb3099d892f442d
                                                                                                                                                                • Opcode Fuzzy Hash: b1f4a4ba26ec96e6bb88116b2b015f126d58dffa6376e7bf34eaa6df3d4e115c
                                                                                                                                                                • Instruction Fuzzy Hash: 9811A961F2C24282FB54A3265D6A139619A9F497B0F340734F83EC77DADF2CB501A700
                                                                                                                                                                Function 00007FF601636C20 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00007FF6016368E0: VirtualFree.KERNELBASE(?,?,?,?,00007FF601636C4A), ref: 00007FF6016368EA
                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF601636C4D
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000017.00000002.2873167826.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000017.00000002.2873135029.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873586684.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873641021.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873669846.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873708103.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873735112.00007FF601827000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601828000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874013552.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874044593.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874077418.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874105060.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874134297.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_23_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AcquireExclusiveFreeLockVirtual
                                                                                                                                                                • String ID: bitset reset argument out of range
                                                                                                                                                                • API String ID: 3050191949-1934458321
                                                                                                                                                                • Opcode ID: d2ea4483b421a4c1521c1fdf0e4af091754b0b9eeaaf9a1c183d858548ee5808
                                                                                                                                                                • Instruction ID: 95b701ddf762dca2fe42a650d09a55da30daca80fb6b80a73f70785b5f32a609
                                                                                                                                                                • Opcode Fuzzy Hash: d2ea4483b421a4c1521c1fdf0e4af091754b0b9eeaaf9a1c183d858548ee5808
                                                                                                                                                                • Instruction Fuzzy Hash: 0A012852F24A1A51FF449B12ED083B45252DF55FE4F248234ED2E8BBD9DC2C96C39314
                                                                                                                                                                Function 00007FF6016DD8F0 Relevance: 3.1, APIs: 2, Instructions: 89COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000017.00000002.2873167826.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000017.00000002.2873135029.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873586684.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873641021.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873669846.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873708103.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873735112.00007FF601827000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601828000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874013552.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874044593.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874077418.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874105060.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874134297.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_23_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: __free_lconv_mon__free_lconv_num
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2148069796-0
                                                                                                                                                                • Opcode ID: dc2808a4693c229ecebaba5656bc8de1752d7a49b52cbcdba97fae550ad5a1b6
                                                                                                                                                                • Instruction ID: 5dc93779d3cd0063e3155c7ba23b82f880ebe8716b034d8e0f7acf595c21f406
                                                                                                                                                                • Opcode Fuzzy Hash: dc2808a4693c229ecebaba5656bc8de1752d7a49b52cbcdba97fae550ad5a1b6
                                                                                                                                                                • Instruction Fuzzy Hash: 77412E22E2954785EF60AF66C8503BC63A5EF94B94F384131FA4D8B6C9DF2CE481A350
                                                                                                                                                                Function 00007FF6015DE310 Relevance: 3.0, APIs: 2, Instructions: 37registryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                • RegOpenKeyExW.KERNELBASE(?,?,?,?,00000000,00000000,?,00007FF6015B4008,?,?,?,?,?,?,?), ref: 00007FF6015DE346
                                                                                                                                                                • RegCloseKey.KERNELBASE(?,?,?,?,00000000,00000000,?,00007FF6015B4008,?,?,?,?,?,?,?), ref: 00007FF6015DE382
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000017.00000002.2873167826.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000017.00000002.2873135029.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873586684.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873641021.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873669846.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873708103.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873735112.00007FF601827000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601828000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874013552.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874044593.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874077418.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874105060.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874134297.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_23_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseOpen
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 47109696-0
                                                                                                                                                                • Opcode ID: 933e926596a06471e92df1a4e62f944b0b409fe6c0c7a8920014ff44127c1987
                                                                                                                                                                • Instruction ID: 7bbe2cb4bb51acdcff6da2e3057b9ab404ab878b7f579c62acaef8dc611e427d
                                                                                                                                                                • Opcode Fuzzy Hash: 933e926596a06471e92df1a4e62f944b0b409fe6c0c7a8920014ff44127c1987
                                                                                                                                                                • Instruction Fuzzy Hash: B4018662A29F4181FB514B15E85177A73A4FB84BD4F104031EE4E8B760DF3CD5918B40
                                                                                                                                                                Function 00007FF6016AD10C Relevance: 1.5, APIs: 1, Instructions: 21COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000017.00000002.2873167826.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000017.00000002.2873135029.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873586684.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873641021.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873669846.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873708103.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873735112.00007FF601827000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601828000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874013552.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874044593.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874077418.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874105060.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874134297.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_23_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 680105476-0
                                                                                                                                                                • Opcode ID: 010881584f4c8f14d087e0dce1396826a372b9952819a28506ffc4606721903a
                                                                                                                                                                • Instruction ID: 28f0b4442e9b0bcf6f0bf5b24aefde21a69e177f90919bd535760fec3455cefc
                                                                                                                                                                • Opcode Fuzzy Hash: 010881584f4c8f14d087e0dce1396826a372b9952819a28506ffc4606721903a
                                                                                                                                                                • Instruction Fuzzy Hash: 90E0EC91E391174AFFA862E11D2607500940F59372EF81B34F93DC4AC2AE1CB8916910
                                                                                                                                                                Function 00007FF6016368E0 Relevance: 1.3, APIs: 1, Instructions: 13COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 270 7ff6016368e0-7ff6016368f2 VirtualFree 271 7ff6016368fb-7ff6016368ff 270->271 272 7ff6016368f4-7ff6016368fa 270->272
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000017.00000002.2873167826.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000017.00000002.2873135029.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873586684.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873641021.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873669846.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873708103.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873735112.00007FF601827000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601828000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874013552.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874044593.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874077418.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874105060.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874134297.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_23_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FreeVirtual
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1263568516-0
                                                                                                                                                                • Opcode ID: 7f068186371cfa2cbc415d46d6cc3bcf492052744b8d93128e587f3724b3874e
                                                                                                                                                                • Instruction ID: 761d9a67a5e8db44984f6e8ab1da2a658e6baf73234977b95493f043e1f6fea8
                                                                                                                                                                • Opcode Fuzzy Hash: 7f068186371cfa2cbc415d46d6cc3bcf492052744b8d93128e587f3724b3874e
                                                                                                                                                                • Instruction Fuzzy Hash: F7C08CA4F3A00AC0F3681626AC8063412501B28B02FF01830C70D9EA81FD2CA3573B20

                                                                                                                                                                Non-executed Functions

                                                                                                                                                                Function 00007FF6016C79A8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000017.00000002.2873167826.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000017.00000002.2873135029.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873586684.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873641021.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873669846.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873708103.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873735112.00007FF601827000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601828000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874013552.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874044593.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874077418.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874105060.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874134297.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_23_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1239891234-0
                                                                                                                                                                • Opcode ID: 67507098db1e038272acff94c071f3ca6f5f98bbf6a5a3d7cd1ec06764c68782
                                                                                                                                                                • Instruction ID: 6f71e7e2435d7a96ebb076d1b13289feb31f6aa7b3eced22918d1f83abe520a0
                                                                                                                                                                • Opcode Fuzzy Hash: 67507098db1e038272acff94c071f3ca6f5f98bbf6a5a3d7cd1ec06764c68782
                                                                                                                                                                • Instruction Fuzzy Hash: 29316132618B8189DB608F65E8407AE73A4FB89794F640535EE8D83B99DF38D685CB00
                                                                                                                                                                Function 00007FF6016D89C4 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000017.00000002.2873167826.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000017.00000002.2873135029.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873586684.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873641021.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873669846.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873708103.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873735112.00007FF601827000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601828000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874013552.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874044593.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874077418.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874105060.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874134297.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_23_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Value$ErrorLast
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2506987500-0
                                                                                                                                                                • Opcode ID: 6d55a9b95411240e1d0a389477a21a924fb7d4dbbbfe1976a58eef717f8dc734
                                                                                                                                                                • Instruction ID: 8bbd980ada6228bdb7d2c199d94a4972345f4293b3678631fbdd3198a2114c28
                                                                                                                                                                • Opcode Fuzzy Hash: 6d55a9b95411240e1d0a389477a21a924fb7d4dbbbfe1976a58eef717f8dc734
                                                                                                                                                                • Instruction Fuzzy Hash: 74417E21F2D24342FB58A3255C5A579218A9F457B4F381B34F93EC77DAEE2CB901A301
                                                                                                                                                                Function 00007FF6016D9EC4 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • FreeLibrary.KERNEL32(?,00000000,00007FF6016D9A24,?,?,00000000,00007FF6016DC4BB,?,?,E0000008,00007FF6016C2CDD,?,?,?,?,00007FF6016C2D05), ref: 00007FF6016DA040
                                                                                                                                                                • GetProcAddress.KERNEL32(?,00000000,00007FF6016D9A24,?,?,00000000,00007FF6016DC4BB,?,?,E0000008,00007FF6016C2CDD,?,?,?,?,00007FF6016C2D05), ref: 00007FF6016DA04C
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000017.00000002.2873167826.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000017.00000002.2873135029.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873586684.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873641021.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873669846.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873708103.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873735112.00007FF601827000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601828000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874013552.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874044593.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874077418.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874105060.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874134297.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_23_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressFreeLibraryProc
                                                                                                                                                                • String ID: MZx$api-ms-$ext-ms-
                                                                                                                                                                • API String ID: 3013587201-2431898299
                                                                                                                                                                • Opcode ID: cb6afd8e86260f2c5cf56879aa60b9a3c5262db9daba503835303966bb6393b6
                                                                                                                                                                • Instruction ID: 27b4fd18a65da117c08ffe56af9430ef0f95f366b7e7c31089012cb18fa08c09
                                                                                                                                                                • Opcode Fuzzy Hash: cb6afd8e86260f2c5cf56879aa60b9a3c5262db9daba503835303966bb6393b6
                                                                                                                                                                • Instruction Fuzzy Hash: 0341D022F2AA0285FB56CB16AC409752395BF46BE4F788135ED0DDB794EE3CE949D300
                                                                                                                                                                Function 00007FF6016E6854 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LoadLibraryExW.KERNEL32(?,?,?,00007FF6016E677B,?,?,00000000,00007FF6016D4E76,?,?,?,00007FF6016B01C9), ref: 00007FF6016E68D9
                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,00007FF6016E677B,?,?,00000000,00007FF6016D4E76,?,?,?,00007FF6016B01C9), ref: 00007FF6016E68E7
                                                                                                                                                                • LoadLibraryExW.KERNEL32(?,?,?,00007FF6016E677B,?,?,00000000,00007FF6016D4E76,?,?,?,00007FF6016B01C9), ref: 00007FF6016E6911
                                                                                                                                                                • FreeLibrary.KERNEL32(?,?,?,00007FF6016E677B,?,?,00000000,00007FF6016D4E76,?,?,?,00007FF6016B01C9), ref: 00007FF6016E6957
                                                                                                                                                                • GetProcAddress.KERNEL32(?,?,?,00007FF6016E677B,?,?,00000000,00007FF6016D4E76,?,?,?,00007FF6016B01C9), ref: 00007FF6016E6963
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000017.00000002.2873167826.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000017.00000002.2873135029.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873586684.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873641021.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873669846.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873708103.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873735112.00007FF601827000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601828000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874013552.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874044593.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874077418.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874105060.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874134297.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_23_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                • String ID: MZx$api-ms-
                                                                                                                                                                • API String ID: 2559590344-259127448
                                                                                                                                                                • Opcode ID: af351f1512d556d3e52e57a4f1eb229a770d03d8afe3a936cd94884c4eed4c8e
                                                                                                                                                                • Instruction ID: e06cb065b737cfc45e74704ee0eeb98994545224907b63ab55c481ae1e4d9f94
                                                                                                                                                                • Opcode Fuzzy Hash: af351f1512d556d3e52e57a4f1eb229a770d03d8afe3a936cd94884c4eed4c8e
                                                                                                                                                                • Instruction Fuzzy Hash: 5031A521B2AA4691EF52DB02DC0097973D8BF55BA0F694635ED1D8B7A0EF3CE6499300
                                                                                                                                                                Function 00007FF6016C2C64 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000017.00000002.2873167826.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000017.00000002.2873135029.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873586684.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873641021.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873669846.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873708103.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873735112.00007FF601827000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601828000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874013552.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874044593.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874077418.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874105060.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874134297.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_23_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                • API String ID: 4061214504-1276376045
                                                                                                                                                                • Opcode ID: 1d4366ffc01efcc9637b8311f10b1165f6b9887ae79c0dd5d827d3eda386a67a
                                                                                                                                                                • Instruction ID: ab5222240554964ee8bb1121715143f93e79d082d0fe98a904e3829c15e9e43f
                                                                                                                                                                • Opcode Fuzzy Hash: 1d4366ffc01efcc9637b8311f10b1165f6b9887ae79c0dd5d827d3eda386a67a
                                                                                                                                                                • Instruction Fuzzy Hash: 61F0F671F19B0681FF609B64E8647396320EF89B61F740639D96E856E0CF3CD689D300
                                                                                                                                                                Function 00007FF6016D8C04 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • FlsGetValue.KERNEL32(?,?,?,00007FF6016C7C1F,?,?,00000000,00007FF6016C7B36,?,?,?,?,?,00007FF6016C7CE2), ref: 00007FF6016D8C23
                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,?,00007FF6016C7C1F,?,?,00000000,00007FF6016C7B36,?,?,?,?,?,00007FF6016C7CE2), ref: 00007FF6016D8C42
                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,?,00007FF6016C7C1F,?,?,00000000,00007FF6016C7B36,?,?,?,?,?,00007FF6016C7CE2), ref: 00007FF6016D8C6A
                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,?,00007FF6016C7C1F,?,?,00000000,00007FF6016C7B36,?,?,?,?,?,00007FF6016C7CE2), ref: 00007FF6016D8C7B
                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,?,00007FF6016C7C1F,?,?,00000000,00007FF6016C7B36,?,?,?,?,?,00007FF6016C7CE2), ref: 00007FF6016D8C8C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000017.00000002.2873167826.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000017.00000002.2873135029.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873586684.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873641021.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873669846.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873708103.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873735112.00007FF601827000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601828000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874013552.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874044593.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874077418.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874105060.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874134297.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_23_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Value
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3702945584-0
                                                                                                                                                                • Opcode ID: 016175acc8a9e4a2130ad1a6e50a80c1f4eeb2941cf9e5b6e8f987ad1b5671cd
                                                                                                                                                                • Instruction ID: 33bff5a0868b55b41d71c5d7ed172696fe0d3a56e7bffdc8c028ada306b8ffd5
                                                                                                                                                                • Opcode Fuzzy Hash: 016175acc8a9e4a2130ad1a6e50a80c1f4eeb2941cf9e5b6e8f987ad1b5671cd
                                                                                                                                                                • Instruction Fuzzy Hash: 32115E21F2A24282FB58A7365D55579618A9F853F4F345734F83EC77DADE2CF5016200
                                                                                                                                                                Function 00007FF6016369D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 106COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,00000003,00000000,00000000,00007FF6016ABE94), ref: 00007FF601636A2D
                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,00000003,00000000,00000000,00007FF6016ABE94), ref: 00007FF601636AEF
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000017.00000002.2873167826.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000017.00000002.2873135029.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873586684.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873641021.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873669846.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873708103.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873735112.00007FF601827000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601828000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874013552.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874044593.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874077418.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874105060.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874134297.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_23_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExclusiveLock$AcquireRelease
                                                                                                                                                                • String ID: bitset set argument out of range$bitset test argument out of range
                                                                                                                                                                • API String ID: 17069307-1976194836
                                                                                                                                                                • Opcode ID: 96d4c6850ba676fa2b767d9eebe5b29245fbcdaa37287a79f783b1624a5d98b8
                                                                                                                                                                • Instruction ID: 0566cdd11e87b6623c7713b243013ca35e7b905c7224aee6fd432c62e32df5a0
                                                                                                                                                                • Opcode Fuzzy Hash: 96d4c6850ba676fa2b767d9eebe5b29245fbcdaa37287a79f783b1624a5d98b8
                                                                                                                                                                • Instruction Fuzzy Hash: 8E310452B1964662FF688652FE103F95252AF90BD4F608031EF4E87B81DE6CE6C7A204
                                                                                                                                                                Function 00007FF601636B40 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 63COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(00000003,00000000,?,?,00007FF601636A0E,00000003,00000000,00000000,00007FF6016ABE94), ref: 00007FF601636B52
                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(?,?,00007FF601636A0E,00000003,00000000,00000000,00007FF6016ABE94), ref: 00007FF601636BE2
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000017.00000002.2873167826.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000017.00000002.2873135029.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873586684.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873641021.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873669846.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873708103.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873735112.00007FF601827000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601828000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874013552.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874044593.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874077418.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874105060.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874134297.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_23_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExclusiveLock$AcquireRelease
                                                                                                                                                                • String ID: bitset set argument out of range$bitset test argument out of range
                                                                                                                                                                • API String ID: 17069307-1976194836
                                                                                                                                                                • Opcode ID: 456478ecc9a6b56214487322f931ba5b55ea3192d26871a7c494ec2d267068c5
                                                                                                                                                                • Instruction ID: 8cd134ffe5c73908ab82beecc471cce5a0cab9fccdc9d6c57ae4eac51dc985aa
                                                                                                                                                                • Opcode Fuzzy Hash: 456478ecc9a6b56214487322f931ba5b55ea3192d26871a7c494ec2d267068c5
                                                                                                                                                                • Instruction Fuzzy Hash: FA11EF51B2D58A52FF588B51EE683B95217AF00BD0F608030ED0F8B696DE2DA6D7A304
                                                                                                                                                                Function 00007FF6016AF02C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6016ADBDF), ref: 00007FF6016AF070
                                                                                                                                                                • RaiseException.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6016ADBDF), ref: 00007FF6016AF0B6
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000017.00000002.2873167826.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000017.00000002.2873135029.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873586684.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873641021.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873669846.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873708103.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873735112.00007FF601827000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601828000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874013552.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874044593.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874077418.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874105060.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874134297.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_23_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                • String ID: csm
                                                                                                                                                                • API String ID: 2573137834-1018135373
                                                                                                                                                                • Opcode ID: c99fc2966ace2c80c1845fc4762d5a62b34821295e20cae6897f22b212c33cc7
                                                                                                                                                                • Instruction ID: 6e2ad698cceac32c3b1d5ffc1d38ef9a0608f0b2b8e6a9bf7d000d7a03f4f33f
                                                                                                                                                                • Opcode Fuzzy Hash: c99fc2966ace2c80c1845fc4762d5a62b34821295e20cae6897f22b212c33cc7
                                                                                                                                                                • Instruction Fuzzy Hash: C0114F32618B4582EB518F25E84026D77E1FB88B84F684274EE8C47754DF3DD591CB40
                                                                                                                                                                Function 00007FF6015B3CA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21synchronizationCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CreateMutexW.KERNEL32(?,?,?,00007FF6015B41A8,?,?,?,00007FF6016EC49D), ref: 00007FF6015B3CBE
                                                                                                                                                                • WaitForSingleObject.KERNEL32(?,?,?,00007FF6015B41A8,?,?,?,00007FF6016EC49D), ref: 00007FF6015B3CD5
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000017.00000002.2873167826.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000017.00000002.2873135029.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873586684.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873641021.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873669846.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873708103.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873735112.00007FF601827000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601828000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873763169.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2873947695.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874013552.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874044593.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874077418.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874105060.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000017.00000002.2874134297.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_23_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateMutexObjectSingleWait
                                                                                                                                                                • String ID: {A946A6A9-917E-4949-B9BC-6BADA8C7FD63}
                                                                                                                                                                • API String ID: 3113225513-1352562265
                                                                                                                                                                • Opcode ID: 82d645b45fdfb9647c1e0e09b509529ad31e6d39f6b1df1cbc602ed846256368
                                                                                                                                                                • Instruction ID: 3647cb32369fe42b04f26417e6f906082f7ab3e4283e6b3629dc38419dbcdd31
                                                                                                                                                                • Opcode Fuzzy Hash: 82d645b45fdfb9647c1e0e09b509529ad31e6d39f6b1df1cbc602ed846256368
                                                                                                                                                                • Instruction Fuzzy Hash: 84E04822A0A79681FB5A9B7AB8443692590AF48B04F68C074D68D96750DE3D9586C340

                                                                                                                                                                Executed Functions

                                                                                                                                                                Function 00007FF60169E6B0 Relevance: 40.2, APIs: 32, Instructions: 229memoryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 0 7ff60169e6b0-7ff60169e6c2 VirtualFree 1 7ff60169e6c4-7ff60169e6c8 0->1 2 7ff60169e6c9-7ff60169e6d1 GetLastError 0->2 2->1 3 7ff60169e6d3-7ff60169e6f7 2->3 4 7ff60169e733-7ff60169e736 3->4 5 7ff60169e6f9-7ff60169e71d VirtualAlloc 3->5 8 7ff60169ea18-7ff60169ea1b 4->8 9 7ff60169e73c-7ff60169e749 4->9 6 7ff60169e71f-7ff60169e722 5->6 7 7ff60169e724-7ff60169e732 5->7 6->7 10 7ff60169e755-7ff60169e764 GetLastError 6->10 9->10 11 7ff60169e776-7ff60169e799 Sleep VirtualAlloc 10->11 12 7ff60169e766-7ff60169e76b 10->12 11->7 14 7ff60169e79b-7ff60169e7aa GetLastError 11->14 12->11 13 7ff60169e76d-7ff60169e770 12->13 13->11 15 7ff60169e772-7ff60169e774 13->15 16 7ff60169e7b8-7ff60169e7db Sleep VirtualAlloc 14->16 17 7ff60169e7ac-7ff60169e7b1 14->17 15->7 16->7 19 7ff60169e7e1-7ff60169e7f0 GetLastError 16->19 17->16 18 7ff60169e7b3-7ff60169e7b6 17->18 18->15 18->16 20 7ff60169e802-7ff60169e825 Sleep VirtualAlloc 19->20 21 7ff60169e7f2-7ff60169e7f7 19->21 20->7 23 7ff60169e82b-7ff60169e83a GetLastError 20->23 21->20 22 7ff60169e7f9-7ff60169e7fc 21->22 22->15 22->20 24 7ff60169e84c-7ff60169e86f Sleep VirtualAlloc 23->24 25 7ff60169e83c-7ff60169e841 23->25 24->7 27 7ff60169e875-7ff60169e884 GetLastError 24->27 25->24 26 7ff60169e843-7ff60169e846 25->26 26->15 26->24 28 7ff60169e896-7ff60169e8b9 Sleep VirtualAlloc 27->28 29 7ff60169e886-7ff60169e88b 27->29 28->7 31 7ff60169e8bf-7ff60169e8ce GetLastError 28->31 29->28 30 7ff60169e88d-7ff60169e890 29->30 30->15 30->28 32 7ff60169e8e0-7ff60169e903 Sleep VirtualAlloc 31->32 33 7ff60169e8d0-7ff60169e8d5 31->33 32->7 35 7ff60169e909-7ff60169e918 GetLastError 32->35 33->32 34 7ff60169e8d7-7ff60169e8da 33->34 34->15 34->32 36 7ff60169e92a-7ff60169e94d Sleep VirtualAlloc 35->36 37 7ff60169e91a-7ff60169e91f 35->37 36->7 39 7ff60169e953-7ff60169e962 GetLastError 36->39 37->36 38 7ff60169e921-7ff60169e924 37->38 38->15 38->36 40 7ff60169e974-7ff60169e997 Sleep VirtualAlloc 39->40 41 7ff60169e964-7ff60169e969 39->41 40->7 43 7ff60169e99d-7ff60169e9ac GetLastError 40->43 41->40 42 7ff60169e96b-7ff60169e96e 41->42 42->15 42->40 44 7ff60169e9be-7ff60169e9e1 Sleep VirtualAlloc 43->44 45 7ff60169e9ae-7ff60169e9b3 43->45 44->7 47 7ff60169e9e7-7ff60169e9f6 GetLastError 44->47 45->44 46 7ff60169e9b5-7ff60169e9b8 45->46 46->15 46->44 48 7ff60169ea08-7ff60169ea13 Sleep 47->48 49 7ff60169e9f8-7ff60169e9fd 47->49 49->48 50 7ff60169e9ff-7ff60169ea02 49->50 50->15 50->48
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000018.00000002.2875980141.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000018.00000002.2875944571.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876710388.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876847611.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876894141.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876950813.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601827000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF60185A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877519747.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877602702.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877672846.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877746866.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877802210.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_24_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Virtual$AllocErrorFreeLast
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3335258512-0
                                                                                                                                                                • Opcode ID: 96171a4be346dcee1bba5a0798965b96ccbd870a44ce8d95c8ce96f34643c743
                                                                                                                                                                • Instruction ID: 483cee3e563fa248f87df54555cc89f9841ab3c61e4138d5e8245a7ba579b71a
                                                                                                                                                                • Opcode Fuzzy Hash: 96171a4be346dcee1bba5a0798965b96ccbd870a44ce8d95c8ce96f34643c743
                                                                                                                                                                • Instruction Fuzzy Hash: B981A430F2A50743FF6587119CA9B7D2249EF56BC6F340439DA0EC67E0DE2E65849712
                                                                                                                                                                Function 00007FF601636140 Relevance: 37.7, APIs: 30, Instructions: 194sleepmemoryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 51 7ff601636140-7ff601636166 VirtualAlloc 52 7ff601636168-7ff601636170 51->52 53 7ff60163617c-7ff601636186 51->53 52->53 54 7ff601636172-7ff601636175 52->54 54->53 55 7ff601636177-7ff60163617a 54->55 55->53 56 7ff601636187-7ff601636196 GetLastError 55->56 57 7ff6016361a8-7ff6016361c8 Sleep VirtualAlloc 56->57 58 7ff601636198-7ff60163619d 56->58 57->53 60 7ff6016361ca-7ff6016361d9 GetLastError 57->60 58->57 59 7ff60163619f-7ff6016361a2 58->59 59->57 61 7ff6016361a4-7ff6016361a6 59->61 62 7ff6016361e7-7ff601636207 Sleep VirtualAlloc 60->62 63 7ff6016361db-7ff6016361e0 60->63 61->53 62->53 65 7ff60163620d-7ff60163621c GetLastError 62->65 63->62 64 7ff6016361e2-7ff6016361e5 63->64 64->61 64->62 66 7ff60163622e-7ff60163624e Sleep VirtualAlloc 65->66 67 7ff60163621e-7ff601636223 65->67 66->53 69 7ff601636254-7ff601636263 GetLastError 66->69 67->66 68 7ff601636225-7ff601636228 67->68 68->61 68->66 70 7ff601636275-7ff601636295 Sleep VirtualAlloc 69->70 71 7ff601636265-7ff60163626a 69->71 70->53 73 7ff60163629b-7ff6016362aa GetLastError 70->73 71->70 72 7ff60163626c-7ff60163626f 71->72 72->61 72->70 74 7ff6016362bc-7ff6016362dc Sleep VirtualAlloc 73->74 75 7ff6016362ac-7ff6016362b1 73->75 74->53 77 7ff6016362e2-7ff6016362f1 GetLastError 74->77 75->74 76 7ff6016362b3-7ff6016362b6 75->76 76->61 76->74 78 7ff601636303-7ff601636323 Sleep VirtualAlloc 77->78 79 7ff6016362f3-7ff6016362f8 77->79 78->53 81 7ff601636329-7ff601636338 GetLastError 78->81 79->78 80 7ff6016362fa-7ff6016362fd 79->80 80->61 80->78 82 7ff60163634a-7ff60163636a Sleep VirtualAlloc 81->82 83 7ff60163633a-7ff60163633f 81->83 82->53 85 7ff601636370-7ff60163637f GetLastError 82->85 83->82 84 7ff601636341-7ff601636344 83->84 84->61 84->82 86 7ff601636391-7ff6016363b1 Sleep VirtualAlloc 85->86 87 7ff601636381-7ff601636386 85->87 86->53 89 7ff6016363b7-7ff6016363c6 GetLastError 86->89 87->86 88 7ff601636388-7ff60163638b 87->88 88->61 88->86 90 7ff6016363d8-7ff6016363f8 Sleep VirtualAlloc 89->90 91 7ff6016363c8-7ff6016363cd 89->91 90->53 93 7ff6016363fe-7ff60163640d GetLastError 90->93 91->90 92 7ff6016363cf-7ff6016363d2 91->92 92->61 92->90 94 7ff60163641f-7ff60163642a Sleep 93->94 95 7ff60163640f-7ff601636414 93->95 95->94 96 7ff601636416-7ff601636419 95->96 96->61 96->94
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000018.00000002.2875980141.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000018.00000002.2875944571.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876710388.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876847611.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876894141.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876950813.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601827000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF60185A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877519747.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877602702.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877672846.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877746866.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877802210.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_24_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocErrorLastSleepVirtual
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2288223010-0
                                                                                                                                                                • Opcode ID: 1abe398b5e4067dad80377d2405b38ad508f29916b91bb9ae62f50e1799e505e
                                                                                                                                                                • Instruction ID: eb4c2151cbcbd6fd6739a0bdc2c1cd3f3d2c90efd36acb1d1da2a48015c4a112
                                                                                                                                                                • Opcode Fuzzy Hash: 1abe398b5e4067dad80377d2405b38ad508f29916b91bb9ae62f50e1799e505e
                                                                                                                                                                • Instruction Fuzzy Hash: D471C830F2A90752FF6A4715DC59F396251AF97B86F340438DD0EC26E1CE3D6B8AA211
                                                                                                                                                                Function 00007FF6016D8B3C Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,00007FF6016C5D7D,?,?,?,?,00007FF6016D800A,?,?,00000000,00007FF6016B0136,?,?,?), ref: 00007FF6016D8B4B
                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,?,00007FF6016C5D7D,?,?,?,?,00007FF6016D800A,?,?,00000000,00007FF6016B0136,?,?,?), ref: 00007FF6016D8B81
                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,?,00007FF6016C5D7D,?,?,?,?,00007FF6016D800A,?,?,00000000,00007FF6016B0136,?,?,?), ref: 00007FF6016D8BAE
                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,?,00007FF6016C5D7D,?,?,?,?,00007FF6016D800A,?,?,00000000,00007FF6016B0136,?,?,?), ref: 00007FF6016D8BBF
                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,?,00007FF6016C5D7D,?,?,?,?,00007FF6016D800A,?,?,00000000,00007FF6016B0136,?,?,?), ref: 00007FF6016D8BD0
                                                                                                                                                                • SetLastError.KERNEL32(?,?,?,00007FF6016C5D7D,?,?,?,?,00007FF6016D800A,?,?,00000000,00007FF6016B0136,?,?,?), ref: 00007FF6016D8BEB
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000018.00000002.2875980141.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000018.00000002.2875944571.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876710388.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876847611.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876894141.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876950813.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601827000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF60185A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877519747.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877602702.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877672846.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877746866.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877802210.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_24_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Value$ErrorLast
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2506987500-0
                                                                                                                                                                • Opcode ID: 368c2df8ae95dba3fcdb796500d47460c5f77c72244a2b7d6f6e754e81781c7b
                                                                                                                                                                • Instruction ID: 027fdc1de553de053e38980be6963603d59ac909254af25a5fb3099d892f442d
                                                                                                                                                                • Opcode Fuzzy Hash: 368c2df8ae95dba3fcdb796500d47460c5f77c72244a2b7d6f6e754e81781c7b
                                                                                                                                                                • Instruction Fuzzy Hash: 9811A961F2C24282FB54A3265D6A139619A9F497B0F340734F83EC77DADF2CB501A700
                                                                                                                                                                Function 00007FF6016DD8F0 Relevance: 3.1, APIs: 2, Instructions: 89COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000018.00000002.2875980141.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000018.00000002.2875944571.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876710388.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876847611.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876894141.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876950813.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601827000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF60185A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877519747.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877602702.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877672846.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877746866.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877802210.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_24_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: __free_lconv_mon__free_lconv_num
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2148069796-0
                                                                                                                                                                • Opcode ID: dc2808a4693c229ecebaba5656bc8de1752d7a49b52cbcdba97fae550ad5a1b6
                                                                                                                                                                • Instruction ID: 5dc93779d3cd0063e3155c7ba23b82f880ebe8716b034d8e0f7acf595c21f406
                                                                                                                                                                • Opcode Fuzzy Hash: dc2808a4693c229ecebaba5656bc8de1752d7a49b52cbcdba97fae550ad5a1b6
                                                                                                                                                                • Instruction Fuzzy Hash: 77412E22E2954785EF60AF66C8503BC63A5EF94B94F384131FA4D8B6C9DF2CE481A350
                                                                                                                                                                Function 00007FF6015DE310 Relevance: 3.0, APIs: 2, Instructions: 37registryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                • RegOpenKeyExW.KERNELBASE(?,?,?,?,00000000,00000000,?,00007FF6015B4008,?,?,?,?,?,?,?), ref: 00007FF6015DE346
                                                                                                                                                                • RegCloseKey.ADVAPI32(?,?,?,?,00000000,00000000,?,00007FF6015B4008,?,?,?,?,?,?,?), ref: 00007FF6015DE382
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000018.00000002.2875980141.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000018.00000002.2875944571.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876710388.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876847611.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876894141.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876950813.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601827000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF60185A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877519747.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877602702.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877672846.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877746866.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877802210.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_24_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseOpen
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 47109696-0
                                                                                                                                                                • Opcode ID: 933e926596a06471e92df1a4e62f944b0b409fe6c0c7a8920014ff44127c1987
                                                                                                                                                                • Instruction ID: 7bbe2cb4bb51acdcff6da2e3057b9ab404ab878b7f579c62acaef8dc611e427d
                                                                                                                                                                • Opcode Fuzzy Hash: 933e926596a06471e92df1a4e62f944b0b409fe6c0c7a8920014ff44127c1987
                                                                                                                                                                • Instruction Fuzzy Hash: B4018662A29F4181FB514B15E85177A73A4FB84BD4F104031EE4E8B760DF3CD5918B40
                                                                                                                                                                Function 00007FF6016AD10C Relevance: 1.5, APIs: 1, Instructions: 21COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000018.00000002.2875980141.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000018.00000002.2875944571.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876710388.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876847611.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876894141.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876950813.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601827000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF60185A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877519747.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877602702.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877672846.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877746866.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877802210.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_24_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 680105476-0
                                                                                                                                                                • Opcode ID: 010881584f4c8f14d087e0dce1396826a372b9952819a28506ffc4606721903a
                                                                                                                                                                • Instruction ID: 28f0b4442e9b0bcf6f0bf5b24aefde21a69e177f90919bd535760fec3455cefc
                                                                                                                                                                • Opcode Fuzzy Hash: 010881584f4c8f14d087e0dce1396826a372b9952819a28506ffc4606721903a
                                                                                                                                                                • Instruction Fuzzy Hash: 90E0EC91E391174AFFA862E11D2607500940F59372EF81B34F93DC4AC2AE1CB8916910

                                                                                                                                                                Non-executed Functions

                                                                                                                                                                Function 00007FF6016C79A8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000018.00000002.2875980141.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000018.00000002.2875944571.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876710388.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876847611.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876894141.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876950813.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601827000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF60185A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877519747.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877602702.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877672846.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877746866.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877802210.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_24_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1239891234-0
                                                                                                                                                                • Opcode ID: 67507098db1e038272acff94c071f3ca6f5f98bbf6a5a3d7cd1ec06764c68782
                                                                                                                                                                • Instruction ID: 6f71e7e2435d7a96ebb076d1b13289feb31f6aa7b3eced22918d1f83abe520a0
                                                                                                                                                                • Opcode Fuzzy Hash: 67507098db1e038272acff94c071f3ca6f5f98bbf6a5a3d7cd1ec06764c68782
                                                                                                                                                                • Instruction Fuzzy Hash: 29316132618B8189DB608F65E8407AE73A4FB89794F640535EE8D83B99DF38D685CB00
                                                                                                                                                                Function 00007FF6016D89C4 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000018.00000002.2875980141.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000018.00000002.2875944571.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876710388.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876847611.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876894141.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876950813.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601827000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF60185A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877519747.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877602702.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877672846.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877746866.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877802210.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_24_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Value$ErrorLast
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2506987500-0
                                                                                                                                                                • Opcode ID: ddd18bdb851dcdc81ce3a8a11da8349fac4e05d6f997a58477ea5cc265ad7808
                                                                                                                                                                • Instruction ID: 8bbd980ada6228bdb7d2c199d94a4972345f4293b3678631fbdd3198a2114c28
                                                                                                                                                                • Opcode Fuzzy Hash: ddd18bdb851dcdc81ce3a8a11da8349fac4e05d6f997a58477ea5cc265ad7808
                                                                                                                                                                • Instruction Fuzzy Hash: 74417E21F2D24342FB58A3255C5A579218A9F457B4F381B34F93EC77DAEE2CB901A301
                                                                                                                                                                Function 00007FF6016D9EC4 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • FreeLibrary.KERNEL32(?,00000000,00007FF6016D9A24,?,?,00000000,00007FF6016DC4BB,?,?,E0000008,00007FF6016C2CDD,?,?,?,?,00007FF6016C2D05), ref: 00007FF6016DA040
                                                                                                                                                                • GetProcAddress.KERNEL32(?,00000000,00007FF6016D9A24,?,?,00000000,00007FF6016DC4BB,?,?,E0000008,00007FF6016C2CDD,?,?,?,?,00007FF6016C2D05), ref: 00007FF6016DA04C
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000018.00000002.2875980141.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000018.00000002.2875944571.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876710388.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876847611.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876894141.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876950813.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601827000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF60185A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877519747.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877602702.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877672846.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877746866.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877802210.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_24_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressFreeLibraryProc
                                                                                                                                                                • String ID: MZx$api-ms-$ext-ms-
                                                                                                                                                                • API String ID: 3013587201-2431898299
                                                                                                                                                                • Opcode ID: f9501c64a943076b5fa397a2bb0de6dbb76ce913d1e9b7d81c92dceb01c39c7a
                                                                                                                                                                • Instruction ID: 27b4fd18a65da117c08ffe56af9430ef0f95f366b7e7c31089012cb18fa08c09
                                                                                                                                                                • Opcode Fuzzy Hash: f9501c64a943076b5fa397a2bb0de6dbb76ce913d1e9b7d81c92dceb01c39c7a
                                                                                                                                                                • Instruction Fuzzy Hash: 0341D022F2AA0285FB56CB16AC409752395BF46BE4F788135ED0DDB794EE3CE949D300
                                                                                                                                                                Function 00007FF6016E6854 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LoadLibraryExW.KERNEL32(?,?,?,00007FF6016E677B,?,?,00000000,00007FF6016D4E76,?,?,?,00007FF6016B01C9), ref: 00007FF6016E68D9
                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,00007FF6016E677B,?,?,00000000,00007FF6016D4E76,?,?,?,00007FF6016B01C9), ref: 00007FF6016E68E7
                                                                                                                                                                • LoadLibraryExW.KERNEL32(?,?,?,00007FF6016E677B,?,?,00000000,00007FF6016D4E76,?,?,?,00007FF6016B01C9), ref: 00007FF6016E6911
                                                                                                                                                                • FreeLibrary.KERNEL32(?,?,?,00007FF6016E677B,?,?,00000000,00007FF6016D4E76,?,?,?,00007FF6016B01C9), ref: 00007FF6016E6957
                                                                                                                                                                • GetProcAddress.KERNEL32(?,?,?,00007FF6016E677B,?,?,00000000,00007FF6016D4E76,?,?,?,00007FF6016B01C9), ref: 00007FF6016E6963
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000018.00000002.2875980141.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000018.00000002.2875944571.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876710388.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876847611.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876894141.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876950813.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601827000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF60185A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877519747.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877602702.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877672846.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877746866.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877802210.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_24_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                • String ID: MZx$api-ms-
                                                                                                                                                                • API String ID: 2559590344-259127448
                                                                                                                                                                • Opcode ID: 10967b4ae4216aab75a75bc83a781d176f9c97aa5b04a6a62874d75bc89e4877
                                                                                                                                                                • Instruction ID: e06cb065b737cfc45e74704ee0eeb98994545224907b63ab55c481ae1e4d9f94
                                                                                                                                                                • Opcode Fuzzy Hash: 10967b4ae4216aab75a75bc83a781d176f9c97aa5b04a6a62874d75bc89e4877
                                                                                                                                                                • Instruction Fuzzy Hash: 5031A521B2AA4691EF52DB02DC0097973D8BF55BA0F694635ED1D8B7A0EF3CE6499300
                                                                                                                                                                Function 00007FF6016C2C64 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000018.00000002.2875980141.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000018.00000002.2875944571.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876710388.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876847611.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876894141.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876950813.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601827000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF60185A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877519747.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877602702.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877672846.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877746866.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877802210.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_24_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                • API String ID: 4061214504-1276376045
                                                                                                                                                                • Opcode ID: 1d4366ffc01efcc9637b8311f10b1165f6b9887ae79c0dd5d827d3eda386a67a
                                                                                                                                                                • Instruction ID: ab5222240554964ee8bb1121715143f93e79d082d0fe98a904e3829c15e9e43f
                                                                                                                                                                • Opcode Fuzzy Hash: 1d4366ffc01efcc9637b8311f10b1165f6b9887ae79c0dd5d827d3eda386a67a
                                                                                                                                                                • Instruction Fuzzy Hash: 61F0F671F19B0681FF609B64E8647396320EF89B61F740639D96E856E0CF3CD689D300
                                                                                                                                                                Function 00007FF6016D8C04 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • FlsGetValue.KERNEL32(?,?,?,00007FF6016C7C1F,?,?,00000000,00007FF6016C7B36,?,?,?,?,?,00007FF6016C7CE2), ref: 00007FF6016D8C23
                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,?,00007FF6016C7C1F,?,?,00000000,00007FF6016C7B36,?,?,?,?,?,00007FF6016C7CE2), ref: 00007FF6016D8C42
                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,?,00007FF6016C7C1F,?,?,00000000,00007FF6016C7B36,?,?,?,?,?,00007FF6016C7CE2), ref: 00007FF6016D8C6A
                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,?,00007FF6016C7C1F,?,?,00000000,00007FF6016C7B36,?,?,?,?,?,00007FF6016C7CE2), ref: 00007FF6016D8C7B
                                                                                                                                                                • FlsSetValue.KERNEL32(?,?,?,00007FF6016C7C1F,?,?,00000000,00007FF6016C7B36,?,?,?,?,?,00007FF6016C7CE2), ref: 00007FF6016D8C8C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000018.00000002.2875980141.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000018.00000002.2875944571.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876710388.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876847611.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876894141.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876950813.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601827000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF60185A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877519747.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877602702.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877672846.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877746866.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877802210.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_24_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Value
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3702945584-0
                                                                                                                                                                • Opcode ID: 6df32c363f93027535a58082ab969ab212e2edb6143c0f530fe9c5f73bba3e24
                                                                                                                                                                • Instruction ID: 33bff5a0868b55b41d71c5d7ed172696fe0d3a56e7bffdc8c028ada306b8ffd5
                                                                                                                                                                • Opcode Fuzzy Hash: 6df32c363f93027535a58082ab969ab212e2edb6143c0f530fe9c5f73bba3e24
                                                                                                                                                                • Instruction Fuzzy Hash: 32115E21F2A24282FB58A7365D55579618A9F853F4F345734F83EC77DADE2CF5016200
                                                                                                                                                                Function 00007FF6016369D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 106COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,00000003,00000000,00000000,00007FF6016ABE94), ref: 00007FF601636A2D
                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,00000003,00000000,00000000,00007FF6016ABE94), ref: 00007FF601636AEF
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000018.00000002.2875980141.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000018.00000002.2875944571.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876710388.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876847611.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876894141.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876950813.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601827000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF60185A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877519747.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877602702.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877672846.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877746866.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877802210.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_24_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExclusiveLock$AcquireRelease
                                                                                                                                                                • String ID: bitset set argument out of range$bitset test argument out of range
                                                                                                                                                                • API String ID: 17069307-1976194836
                                                                                                                                                                • Opcode ID: 96d4c6850ba676fa2b767d9eebe5b29245fbcdaa37287a79f783b1624a5d98b8
                                                                                                                                                                • Instruction ID: 0566cdd11e87b6623c7713b243013ca35e7b905c7224aee6fd432c62e32df5a0
                                                                                                                                                                • Opcode Fuzzy Hash: 96d4c6850ba676fa2b767d9eebe5b29245fbcdaa37287a79f783b1624a5d98b8
                                                                                                                                                                • Instruction Fuzzy Hash: 8E310452B1964662FF688652FE103F95252AF90BD4F608031EF4E87B81DE6CE6C7A204
                                                                                                                                                                Function 00007FF601636B40 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 63COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(00000003,00000000,?,?,00007FF601636A0E,00000003,00000000,00000000,00007FF6016ABE94), ref: 00007FF601636B52
                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(?,?,00007FF601636A0E,00000003,00000000,00000000,00007FF6016ABE94), ref: 00007FF601636BE2
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000018.00000002.2875980141.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000018.00000002.2875944571.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876710388.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876847611.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876894141.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876950813.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601827000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF60185A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877519747.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877602702.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877672846.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877746866.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877802210.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_24_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExclusiveLock$AcquireRelease
                                                                                                                                                                • String ID: bitset set argument out of range$bitset test argument out of range
                                                                                                                                                                • API String ID: 17069307-1976194836
                                                                                                                                                                • Opcode ID: 456478ecc9a6b56214487322f931ba5b55ea3192d26871a7c494ec2d267068c5
                                                                                                                                                                • Instruction ID: 8cd134ffe5c73908ab82beecc471cce5a0cab9fccdc9d6c57ae4eac51dc985aa
                                                                                                                                                                • Opcode Fuzzy Hash: 456478ecc9a6b56214487322f931ba5b55ea3192d26871a7c494ec2d267068c5
                                                                                                                                                                • Instruction Fuzzy Hash: FA11EF51B2D58A52FF588B51EE683B95217AF00BD0F608030ED0F8B696DE2DA6D7A304
                                                                                                                                                                Function 00007FF6016AF02C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6016ADBDF), ref: 00007FF6016AF070
                                                                                                                                                                • RaiseException.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6016ADBDF), ref: 00007FF6016AF0B6
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000018.00000002.2875980141.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000018.00000002.2875944571.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876710388.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876847611.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876894141.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876950813.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601827000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF60185A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877519747.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877602702.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877672846.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877746866.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877802210.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_24_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                • String ID: csm
                                                                                                                                                                • API String ID: 2573137834-1018135373
                                                                                                                                                                • Opcode ID: c99fc2966ace2c80c1845fc4762d5a62b34821295e20cae6897f22b212c33cc7
                                                                                                                                                                • Instruction ID: 6e2ad698cceac32c3b1d5ffc1d38ef9a0608f0b2b8e6a9bf7d000d7a03f4f33f
                                                                                                                                                                • Opcode Fuzzy Hash: c99fc2966ace2c80c1845fc4762d5a62b34821295e20cae6897f22b212c33cc7
                                                                                                                                                                • Instruction Fuzzy Hash: C0114F32618B4582EB518F25E84026D77E1FB88B84F684274EE8C47754DF3DD591CB40
                                                                                                                                                                Function 00007FF6015B3CA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21synchronizationCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CreateMutexW.KERNEL32(?,?,?,00007FF6015B41A8,?,?,?,00007FF6016EC49D), ref: 00007FF6015B3CBE
                                                                                                                                                                • WaitForSingleObject.KERNEL32(?,?,?,00007FF6015B41A8,?,?,?,00007FF6016EC49D), ref: 00007FF6015B3CD5
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000018.00000002.2875980141.00007FF601581000.00000020.00000001.01000000.00000027.sdmp, Offset: 00007FF601580000, based on PE: true
                                                                                                                                                                • Associated: 00000018.00000002.2875944571.00007FF601580000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876710388.00007FF6017BA000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876847611.00007FF601818000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876894141.00007FF601819000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2876950813.00007FF60181A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601827000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601843000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601848000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184B000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF60184F000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877006418.00007FF601851000.00000008.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601852000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF601856000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877372430.00007FF60185A000.00000004.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877519747.00007FF601862000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877602702.00007FF60187D000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877672846.00007FF60187F000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877746866.00007FF601880000.00000020.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                • Associated: 00000018.00000002.2877802210.00007FF601881000.00000002.00000001.01000000.00000027.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_24_2_7ff601580000_setup.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateMutexObjectSingleWait
                                                                                                                                                                • String ID: {A946A6A9-917E-4949-B9BC-6BADA8C7FD63}
                                                                                                                                                                • API String ID: 3113225513-1352562265
                                                                                                                                                                • Opcode ID: 82d645b45fdfb9647c1e0e09b509529ad31e6d39f6b1df1cbc602ed846256368
                                                                                                                                                                • Instruction ID: 3647cb32369fe42b04f26417e6f906082f7ab3e4283e6b3629dc38419dbcdd31
                                                                                                                                                                • Opcode Fuzzy Hash: 82d645b45fdfb9647c1e0e09b509529ad31e6d39f6b1df1cbc602ed846256368
                                                                                                                                                                • Instruction Fuzzy Hash: 84E04822A0A79681FB5A9B7AB8443692590AF48B04F68C074D68D96750DE3D9586C340

                                                                                                                                                                Executed Functions

                                                                                                                                                                Function 00007FF690EF1021 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 84threadlibraryloaderCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                • SetThreadDescription, xrefs: 00007FF690EF110A
                                                                                                                                                                • ..\..\third_party\libc++\src\include\string_view:316: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 00007FF690EF1181
                                                                                                                                                                • ..\..\third_party\libc++\src\include\string_view:314: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 00007FF690EF116E
                                                                                                                                                                • Kernel32.dll, xrefs: 00007FF690EF10FD
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Thread$Current$AcquireAddressDebuggerDescriptionExclusiveHandleInit_thread_headerLockModulePresentProc
                                                                                                                                                                • String ID: ..\..\third_party\libc++\src\include\string_view:314: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:316: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$Kernel32.dll$SetThreadDescription
                                                                                                                                                                • API String ID: 3729234938-2641643690
                                                                                                                                                                • Opcode ID: faca622852087d1704f99baaa4784375c0e7dc7923401ded6ced242d7dc70491
                                                                                                                                                                • Instruction ID: 498bc2af6cec0fe5d16b541f38ae706c976d1cd1e45839db4e87577f685b1590
                                                                                                                                                                • Opcode Fuzzy Hash: faca622852087d1704f99baaa4784375c0e7dc7923401ded6ced242d7dc70491
                                                                                                                                                                • Instruction Fuzzy Hash: 06419A31E0DA9AA5FB74CB25E8502B82369EF40BC4F6445F1CA5DC23A4EF3DE5858300
                                                                                                                                                                Function 00007FF69105C054 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressFreeLibraryProc
                                                                                                                                                                • String ID: MZx$api-ms-$ext-ms-
                                                                                                                                                                • API String ID: 3013587201-2431898299
                                                                                                                                                                • Opcode ID: b6d216a4bd4db937604f2baf6b3c8ba3c94385b96dce63499211f6bd3dee3229
                                                                                                                                                                • Instruction ID: 7cbc727552a9fc5359d1fe0d2d63db7acc6558f4544b0651455ce599a986025f
                                                                                                                                                                • Opcode Fuzzy Hash: b6d216a4bd4db937604f2baf6b3c8ba3c94385b96dce63499211f6bd3dee3229
                                                                                                                                                                • Instruction Fuzzy Hash: F0413121B19A0251EB36CB13A91067532A9FF4ABE0F684575DD2DC7788EF3DE8068348
                                                                                                                                                                Function 00007FF69105ACCC Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Value$ErrorLast
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2506987500-0
                                                                                                                                                                • Opcode ID: 5e819eee5f941acc80285f1f4572e434b4051a8ffd5ff88856bda1a08edbe693
                                                                                                                                                                • Instruction ID: 527afa3cf5753bb18db67405d8c48344b4510d1a2db27c0f5d666fc87f0a2f70
                                                                                                                                                                • Opcode Fuzzy Hash: 5e819eee5f941acc80285f1f4572e434b4051a8ffd5ff88856bda1a08edbe693
                                                                                                                                                                • Instruction Fuzzy Hash: 92118E21A0964282FBB8B32355551792292EF857F4F340BB4EC3FC76DADE3DB5428610
                                                                                                                                                                Function 00007FF6910463B8 Relevance: 4.5, APIs: 3, Instructions: 14COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Process$CurrentExitTerminate
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1703294689-0
                                                                                                                                                                • Opcode ID: f7596838b431f73576414f4c936955933bb9169cbf52a1bc5421841c8393f86b
                                                                                                                                                                • Instruction ID: 85853c24accbbda2aadfdbe4935d11d07cbccad8a1434c3b45e59edf5b618f90
                                                                                                                                                                • Opcode Fuzzy Hash: f7596838b431f73576414f4c936955933bb9169cbf52a1bc5421841c8393f86b
                                                                                                                                                                • Instruction Fuzzy Hash: 76D09E50F0978292EB746B7098D50781251DF99712FB058F8D84B973D3FE6DA44E8600
                                                                                                                                                                Function 00007FF69105FAB4 Relevance: 3.1, APIs: 2, Instructions: 89COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: __free_lconv_mon__free_lconv_num
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2148069796-0
                                                                                                                                                                • Opcode ID: f1176818f2eab063e94d1bd9403176a662116b8293d2bce0bc87b567ca652221
                                                                                                                                                                • Instruction ID: 6994b9b308284c9596fceb1fea41857263c513caf6ff720dc5aa76a373f31a09
                                                                                                                                                                • Opcode Fuzzy Hash: f1176818f2eab063e94d1bd9403176a662116b8293d2bce0bc87b567ca652221
                                                                                                                                                                • Instruction Fuzzy Hash: 5141F732A49646C4FF719F22C5603B92660EF84B84F284871EE4DC7686DE3EE982C350
                                                                                                                                                                Function 00007FF690FD3D90 Relevance: 3.1, APIs: 2, Instructions: 62COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Init_thread_header$CriticalEnterSection
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 640747144-0
                                                                                                                                                                • Opcode ID: 817404b58ff89ea33dec8712b33ad5890337086e5f569173ccda8b19c16e2fef
                                                                                                                                                                • Instruction ID: 0cd9bbdae1148988ca6ef47da1c6249eee643736e077349e0df412e606b938b0
                                                                                                                                                                • Opcode Fuzzy Hash: 817404b58ff89ea33dec8712b33ad5890337086e5f569173ccda8b19c16e2fef
                                                                                                                                                                • Instruction Fuzzy Hash: 71311B34A0DA06A5FB709B14E8501B83760FB407A4F6046B2D99DC36E1DF2EF98A9701
                                                                                                                                                                Function 00007FF690EF8FB0 Relevance: 2.5, APIs: 2, Instructions: 36memoryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocErrorLastVirtual
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 497505419-0
                                                                                                                                                                • Opcode ID: 8225ef6c57825342cf58a465dec6998212393e810d9d879f41094cb71a3c63ba
                                                                                                                                                                • Instruction ID: 4c4cdae632ff1183e9eed1d71d023d4024af17d3ace1af6e605bc3700148c17e
                                                                                                                                                                • Opcode Fuzzy Hash: 8225ef6c57825342cf58a465dec6998212393e810d9d879f41094cb71a3c63ba
                                                                                                                                                                • Instruction Fuzzy Hash: C1F09072F0951A66FB742321F545B791295DF65B82F2448B1CB4CC6B80DE2DE883D700
                                                                                                                                                                Function 00007FF6910462B0 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleW.KERNEL32(?,?,?,00000000,00007FF691094DCC), ref: 00007FF691046413
                                                                                                                                                                  • Part of subcall function 00007FF691046324: GetModuleHandleExW.KERNEL32 ref: 00007FF691046349
                                                                                                                                                                  • Part of subcall function 00007FF691046324: GetProcAddress.KERNEL32 ref: 00007FF69104635F
                                                                                                                                                                  • Part of subcall function 00007FF691046324: FreeLibrary.KERNEL32 ref: 00007FF691046386
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3947729631-0
                                                                                                                                                                • Opcode ID: 73f43420ce621fcccf5bf489b120bcdaf1dbc6c13a50a0c5a289adbd45853ea0
                                                                                                                                                                • Instruction ID: bf7907a247f197f283accf6797ae33a180e1e7e6ef01bbf68de31a20bed8181b
                                                                                                                                                                • Opcode Fuzzy Hash: 73f43420ce621fcccf5bf489b120bcdaf1dbc6c13a50a0c5a289adbd45853ea0
                                                                                                                                                                • Instruction Fuzzy Hash: 6E218D32A14B41DAEB34CF64C4902AC33A1EB94718FA44675D7AE87AC5FF39D485CB40
                                                                                                                                                                Function 00007FF69102F8E8 Relevance: 1.5, APIs: 1, Instructions: 21COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Concurrency::cancel_current_task
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 118556049-0
                                                                                                                                                                • Opcode ID: 3a26e469ae0980c3c257e97990dab73b7c8d6375a78ac99e8459ca41f02895c8
                                                                                                                                                                • Instruction ID: c860aa5e6d76971ad8024cd54a014a8c38976e422b4917c4f7a9770dd858429b
                                                                                                                                                                • Opcode Fuzzy Hash: 3a26e469ae0980c3c257e97990dab73b7c8d6375a78ac99e8459ca41f02895c8
                                                                                                                                                                • Instruction Fuzzy Hash: FAE0E290F0920B25FF3833A224460B50044AF287F0E3C1FB0E9BD892C2AD1EB4978210
                                                                                                                                                                Function 00007FF690EFD681 Relevance: 1.3, APIs: 1, Instructions: 94COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 420 7ff690efd681-7ff690efd68f 422 7ff690efd690-7ff690efd6a3 call 7ff690efd720 420->422
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLast
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1452528299-0
                                                                                                                                                                • Opcode ID: 137341475a828fe3e91bf5629e8ccce27b678e097b10c46129ee209cd25df4cd
                                                                                                                                                                • Instruction ID: 408d9e7603bdc1fa3350e4e145b78a8e9f0b882e719e7beeec6661b2e6c04563
                                                                                                                                                                • Opcode Fuzzy Hash: 137341475a828fe3e91bf5629e8ccce27b678e097b10c46129ee209cd25df4cd
                                                                                                                                                                • Instruction Fuzzy Hash: 6A41A336B18A4692EB309B3AE55117A6361FB85BE0B104271DF6E87BE1CF2CF546C700
                                                                                                                                                                Function 00007FF690EFF2E9 Relevance: 1.3, APIs: 1, Instructions: 37memoryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocVirtual
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4275171209-0
                                                                                                                                                                • Opcode ID: 05d6e426129b50c1e28e91f5bcb460be173e6d9468c17eb21756d205a902694e
                                                                                                                                                                • Instruction ID: 398122cf0e97ec1d1a0212a1db3e07616960894d7208d6b63940b1785b46bf36
                                                                                                                                                                • Opcode Fuzzy Hash: 05d6e426129b50c1e28e91f5bcb460be173e6d9468c17eb21756d205a902694e
                                                                                                                                                                • Instruction Fuzzy Hash: 38F0B413B4B12666FA36DF51B8062781684AF06BE4F9409B4CE0D467C0EE3CF5CBD200
                                                                                                                                                                Function 00007FF690EF902B Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocErrorLastVirtual
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 497505419-0
                                                                                                                                                                • Opcode ID: 694cf2df6c09ff77bed8b67fc7e5d456c2f05492c126c1e569935fb1614cd60c
                                                                                                                                                                • Instruction ID: 9cb248f6d9cc1f145b6bcf87ee7475923571688c878d35893e19a1e04dcd97e5
                                                                                                                                                                • Opcode Fuzzy Hash: 694cf2df6c09ff77bed8b67fc7e5d456c2f05492c126c1e569935fb1614cd60c
                                                                                                                                                                • Instruction Fuzzy Hash: 70C08C63F0C21AA0FAB113227204B7800858F15FC1E2800B9CE0C41BC08C0CF6C27200
                                                                                                                                                                Function 00007FF690EF9023 Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocErrorLastVirtual
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 497505419-0
                                                                                                                                                                • Opcode ID: 6c692495f21a17b8cbd1482f5513f10ebe3b7e30ac1aa56949a4beb7ffeafb95
                                                                                                                                                                • Instruction ID: 33b656b85e81953d61a8cd1f01cece4de3885918ad638640756c7253e23d8f61
                                                                                                                                                                • Opcode Fuzzy Hash: 6c692495f21a17b8cbd1482f5513f10ebe3b7e30ac1aa56949a4beb7ffeafb95
                                                                                                                                                                • Instruction Fuzzy Hash: 94C08CA3F0C11AA0FAB113227200B7800458F15FC1E2800B9CF0C41BC08C1CF7C27200

                                                                                                                                                                Non-executed Functions

                                                                                                                                                                Function 00007FF690F36370 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 299filelibraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLast$AcquireAddressCounterCreateExclusiveFileFreeHandleLocalLockModulePerformanceProcQuery
                                                                                                                                                                • String ID: ..\..\base\win\security_util.cc$AddACEToPath$GetHandleVerifier$ScopedBlockingCall
                                                                                                                                                                • API String ID: 1175170105-314747623
                                                                                                                                                                • Opcode ID: 876aed4e08f9ee1c8b2a7ec427d513579c48a2828fdb0dd58813a046a0d3e368
                                                                                                                                                                • Instruction ID: 14bea27ffd8c152d777a66c555774f5a7385c9b8827781b8b8db0e42c428bcc5
                                                                                                                                                                • Opcode Fuzzy Hash: 876aed4e08f9ee1c8b2a7ec427d513579c48a2828fdb0dd58813a046a0d3e368
                                                                                                                                                                • Instruction Fuzzy Hash: AAD1B031A0CA82A1EB358B25E4053FAA3A1EF89BE4F544171DE8D87794DF3DE141C701
                                                                                                                                                                Function 00007FF690F08240 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 200fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorFileLast$AcquireCounterCreateExclusiveLockMappingPerformanceQueryView
                                                                                                                                                                • String ID: ..\..\base\files\memory_mapped_file_win.cc$GetHandleVerifier$MapFileRegionToMemory$ScopedBlockingCall
                                                                                                                                                                • API String ID: 140890767-664693454
                                                                                                                                                                • Opcode ID: ddf9eed4df9c7cefa775aaa46ab97517a348af60d5c7798f0d9c6fb5a9c8f3b4
                                                                                                                                                                • Instruction ID: bd942a8789a9732c4e3ea7bd5af69eaf42430a5928bf41a44c61350d47eaa65a
                                                                                                                                                                • Opcode Fuzzy Hash: ddf9eed4df9c7cefa775aaa46ab97517a348af60d5c7798f0d9c6fb5a9c8f3b4
                                                                                                                                                                • Instruction Fuzzy Hash: FF81C022A0EA86A2FB308B35E5517BA73A0FF84B80F505471CE8E93751DF3DE2468300
                                                                                                                                                                Function 00007FF690F601D0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 118filelibraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorFileLast$AcquireAddressAttributesCounterCreateExclusiveHandleLockModulePerformanceProcQuery
                                                                                                                                                                • String ID: ..\..\base\files\file_util_win.cc$GetHandleVerifier$PathHasAccess$ScopedBlockingCall
                                                                                                                                                                • API String ID: 3287860531-2304908607
                                                                                                                                                                • Opcode ID: 0297618bf7ebd476417ae742ac3727360257f7aa91d9750b7820e2f9a788bd22
                                                                                                                                                                • Instruction ID: a975286cfed3ca805fb98b0cbb08bd4ac216cf18525d315e81bc822be78aa9a9
                                                                                                                                                                • Opcode Fuzzy Hash: 0297618bf7ebd476417ae742ac3727360257f7aa91d9750b7820e2f9a788bd22
                                                                                                                                                                • Instruction Fuzzy Hash: F451C022A0CA8AA1FB748B35E4553BA7361EF85794F644271DD4D837A8DF3CE646C700
                                                                                                                                                                Function 00007FF690EF9820 Relevance: 16.6, APIs: 11, Instructions: 110threadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Thread$CurrentPerformancePriorityQuery$CounterInit_thread_header$Frequency
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3595693039-0
                                                                                                                                                                • Opcode ID: fa97657b7f80088f0e12e7475d96ca305fab451ed9861e1ff08226aae36e936e
                                                                                                                                                                • Instruction ID: 1f7a27ca7dc13e7d24751178cdca2524b12d81f1d325a2eaeaf9e6d23cca7342
                                                                                                                                                                • Opcode Fuzzy Hash: fa97657b7f80088f0e12e7475d96ca305fab451ed9861e1ff08226aae36e936e
                                                                                                                                                                • Instruction Fuzzy Hash: 39518C31A09A86A9F721DB24E95527A73A4EF55BD0F6147B1D94E923A4DF3DE082C300
                                                                                                                                                                Function 00007FF690FF7D70 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 134libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressHandleModuleProc
                                                                                                                                                                • String ID: ..\..\base\files\file_win.cc$Close$GetHandleVerifier$ScopedBlockingCall$chrome.dll
                                                                                                                                                                • API String ID: 1646373207-503312030
                                                                                                                                                                • Opcode ID: 3a2ce933a05ce0e7a14c8c890f2d0dca4ff112d494684695f7ca75ed2d14f585
                                                                                                                                                                • Instruction ID: 89d467f0d8f19ad10ff5a35ec4c33a9fee750fb682c932272110ead0271fcf83
                                                                                                                                                                • Opcode Fuzzy Hash: 3a2ce933a05ce0e7a14c8c890f2d0dca4ff112d494684695f7ca75ed2d14f585
                                                                                                                                                                • Instruction Fuzzy Hash: CA514B31A0CB46A0FB349B25E4553B9B3A5EF45784F5044B6DA8E837A5DE3DE286D300
                                                                                                                                                                Function 00007FF690F02BB3 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 131filelibraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLast$AddressCreateFileHandleModuleProc
                                                                                                                                                                • String ID: GetHandleVerifier
                                                                                                                                                                • API String ID: 2959055312-1090674830
                                                                                                                                                                • Opcode ID: 28710fe0cdf8376cc01f55048224cadd56babed9f4631409b8f90358d1134fe9
                                                                                                                                                                • Instruction ID: 4c5e38ff5ed30515175f392efb031fe26b1b682ddca0abd92e087e687ad52902
                                                                                                                                                                • Opcode Fuzzy Hash: 28710fe0cdf8376cc01f55048224cadd56babed9f4631409b8f90358d1134fe9
                                                                                                                                                                • Instruction Fuzzy Hash: 3A51E232B0D642A2FBB98B21A45573D3661EF85790F5084B8CE4F83BD1CE3CE6468310
                                                                                                                                                                Function 00007FF69101B5F0 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 441COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Strings
                                                                                                                                                                • ..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length, xrefs: 00007FF69101B72E
                                                                                                                                                                • ..\..\third_party\libc++\src\include\string_view:316: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 00007FF69101B71B
                                                                                                                                                                • ..\..\third_party\libc++\src\include\string:973: assertion __s != nullptr failed: basic_string(const char*) detected nullptr, xrefs: 00007FF69101B97C
                                                                                                                                                                • ..\..\third_party\libc++\src\include\string_view:314: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 00007FF69101B708
                                                                                                                                                                • ..\..\third_party\libc++\src\include\__string\char_traits.h:146: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 00007FF69101B98F
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID: ..\..\third_party\libc++\src\include\__string\char_traits.h:146: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$..\..\third_party\libc++\src\include\string:973: assertion __s != nullptr failed: basic_string(const char*) detected nullptr$..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length$..\..\third_party\libc++\src\include\string_view:314: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:316: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr
                                                                                                                                                                • API String ID: 0-582601209
                                                                                                                                                                • Opcode ID: 9d3616e217bd0fc2b420405942ae70ddc3c29ca10b92f60253fa3a90832fa52d
                                                                                                                                                                • Instruction ID: 9156292295742ca758700a19280e0c4968efa2334445df2941018d86098c00ea
                                                                                                                                                                • Opcode Fuzzy Hash: 9d3616e217bd0fc2b420405942ae70ddc3c29ca10b92f60253fa3a90832fa52d
                                                                                                                                                                • Instruction Fuzzy Hash: 8B022422B1C68299EB30DB12E4446BA67B0FF59B88F6444B1EE4DC7695DF3EE142C700
                                                                                                                                                                Function 00007FF690EFE9C0 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 379COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExclusiveLock$Release$Acquire
                                                                                                                                                                • String ID: first
                                                                                                                                                                • API String ID: 1021914862-2456940119
                                                                                                                                                                • Opcode ID: ce3731bb3bb09389c5d042a25da46e06cafa946445cb46483a34c9044f277637
                                                                                                                                                                • Instruction ID: 66b6b2399b03dbab2119b097c620ed5b5d997dbde25eb46ddfae8eaa86c62066
                                                                                                                                                                • Opcode Fuzzy Hash: ce3731bb3bb09389c5d042a25da46e06cafa946445cb46483a34c9044f277637
                                                                                                                                                                • Instruction Fuzzy Hash: DDF10172A08A82D2EB348B25F8513B97765EB89B94F1445B1EB5E837A4DF3DF442D300
                                                                                                                                                                Function 00007FF690EFCB60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 237COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExclusiveLockRelease
                                                                                                                                                                • String ID: %s (errno: %d, %s)$..\..\third_party\perfetto\src\tracing\core\shared_memory_arbiter_impl.cc$PERFETTO_CHECK(was_always_bound_)$Shared memory buffer max stall count exceeded; possible deadlock (errno: %d, %s)
                                                                                                                                                                • API String ID: 1766480654-3492137015
                                                                                                                                                                • Opcode ID: 1b2aa5b2e14607fd6b31aef559eb830bfd97c8255c539f5d12708d21682fa189
                                                                                                                                                                • Instruction ID: 5343bfe97dff67df85ac2161b517b6cdfb83a38d15f27cc41a65309204d41362
                                                                                                                                                                • Opcode Fuzzy Hash: 1b2aa5b2e14607fd6b31aef559eb830bfd97c8255c539f5d12708d21682fa189
                                                                                                                                                                • Instruction Fuzzy Hash: C5A1AF32A08A46A6EB34CB25F58037A73A4FB85B84F204175DB4E87BA0DF7DE595C700
                                                                                                                                                                Function 00007FF6910607AC Relevance: 10.7, APIs: 7, Instructions: 171COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2591520935-0
                                                                                                                                                                • Opcode ID: bf14407e123d54877d44eaabe9f62e55ac9c28353948372463efaf71a4c2abc0
                                                                                                                                                                • Instruction ID: 6c93f607db1a7607ca0db804adbf13ae08061b6bb1d17373e1776490282bf018
                                                                                                                                                                • Opcode Fuzzy Hash: bf14407e123d54877d44eaabe9f62e55ac9c28353948372463efaf71a4c2abc0
                                                                                                                                                                • Instruction Fuzzy Hash: 0371AC32B1864A89FB609B61D4402BC33A1FF44788F6446B5CA5D9378DEF3EA895C350
                                                                                                                                                                Function 00007FF6910A3FF0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 359COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000018,00000000), ref: 00007FF6910A40EF
                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000018,00000000), ref: 00007FF6910A4162
                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000018,00000000), ref: 00007FF6910A4394
                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000018,00000000), ref: 00007FF6910A4401
                                                                                                                                                                Strings
                                                                                                                                                                • ..\..\third_party\libc++\src\include\array:234: assertion __n < _Size failed: out-of-bounds access in std::array<T, N>, xrefs: 00007FF6910A4435
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExclusiveLock$AcquireRelease
                                                                                                                                                                • String ID: ..\..\third_party\libc++\src\include\array:234: assertion __n < _Size failed: out-of-bounds access in std::array<T, N>
                                                                                                                                                                • API String ID: 17069307-2696940747
                                                                                                                                                                • Opcode ID: a43984abef3f7162060e55124504f45d6a5cd2ec84ace0ffd697b74d54c90203
                                                                                                                                                                • Instruction ID: 7e26fd3b38b8d1bdb0701c1268096c8c791a205303bda52ec1efc377a2456776
                                                                                                                                                                • Opcode Fuzzy Hash: a43984abef3f7162060e55124504f45d6a5cd2ec84ace0ffd697b74d54c90203
                                                                                                                                                                • Instruction Fuzzy Hash: BEE1E166B18B4586EB65CB16E85437A63A1FB84BE0F288171DE4DC7798DF3DD482C700
                                                                                                                                                                Function 00007FF69104BE54 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1239891234-0
                                                                                                                                                                • Opcode ID: b12e01b7f35bf7aeb4da09fe4c91dd25efb0b6a85c559faa3c7445479d7dc097
                                                                                                                                                                • Instruction ID: a46bcd54adba04f29f4e3277bc0cb5a5e87d986c23ed84241c5eb0e252125676
                                                                                                                                                                • Opcode Fuzzy Hash: b12e01b7f35bf7aeb4da09fe4c91dd25efb0b6a85c559faa3c7445479d7dc097
                                                                                                                                                                • Instruction Fuzzy Hash: 03318436618B8196DB70CF25E8407AE73A0FB89794F640575EA9D83B94DF3DD146CB00
                                                                                                                                                                Function 00007FF690FB7B10 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 314COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExclusiveLock$AcquireRelease
                                                                                                                                                                • String ID: 33333333$UUUUUUUU
                                                                                                                                                                • API String ID: 17069307-3483174168
                                                                                                                                                                • Opcode ID: 4320fa7d8e565114164a57928d0fe030d54e0255491ca40c5519efc3740fac4f
                                                                                                                                                                • Instruction ID: 6724fd1b35c92f54e99f864789c8541dfccbbbbd52e6b7dfec0a6d6505463bea
                                                                                                                                                                • Opcode Fuzzy Hash: 4320fa7d8e565114164a57928d0fe030d54e0255491ca40c5519efc3740fac4f
                                                                                                                                                                • Instruction Fuzzy Hash: 52D1CC32A1D746A2EB348B25E45077977A1EF84BC4F1444B6DE4D87B95CF2DEAC28B00
                                                                                                                                                                Function 00007FF690FED2C0 Relevance: 7.6, APIs: 5, Instructions: 75COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: InfoInit_thread_header$CriticalEnterNativeProductSectionSystemVersion
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1358511000-0
                                                                                                                                                                • Opcode ID: 5aa171f349f10f0f60e2df9de54af626b4310a564b44435d6173846c01f848ba
                                                                                                                                                                • Instruction ID: 8848f28b71335e81d7b253047d165c2a578da593245a319dbd6bbb4daaf15cc4
                                                                                                                                                                • Opcode Fuzzy Hash: 5aa171f349f10f0f60e2df9de54af626b4310a564b44435d6173846c01f848ba
                                                                                                                                                                • Instruction Fuzzy Hash: AD415F31A0DA4A95F770DB14E9906B93360EB84B90F6052B1DA4D937A0CF2DF586C740
                                                                                                                                                                Function 00007FF690FD1AD0 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 265COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                • chrome.dll, xrefs: 00007FF690FD1AD4
                                                                                                                                                                • ..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at, xrefs: 00007FF690FD1D4D
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExclusiveLock$AcquireRelease
                                                                                                                                                                • String ID: ..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at$chrome.dll
                                                                                                                                                                • API String ID: 17069307-2398301442
                                                                                                                                                                • Opcode ID: 36eed156253f92fab8a9394198d775c89c2e7be84382ac9b2ff42a4584f8a6db
                                                                                                                                                                • Instruction ID: a7f8d03c9a0e447b20fc4c569d1fa10f373a28e58719bfafac678419429e8ff9
                                                                                                                                                                • Opcode Fuzzy Hash: 36eed156253f92fab8a9394198d775c89c2e7be84382ac9b2ff42a4584f8a6db
                                                                                                                                                                • Instruction Fuzzy Hash: E9B1CE22A0DB81A2EB358B25D05037967A5FB94B94F148276DF8E87BD5DF3CE291C300
                                                                                                                                                                Function 00007FF690FD6950 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 283COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                • ..\..\third_party\libc++\src\include\optional:801: assertion this->has_value() failed: optional operator* called on a disengaged value, xrefs: 00007FF690FD6D48
                                                                                                                                                                • <, xrefs: 00007FF690FD6CAD
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExclusiveLock$AcquireErrorLast$Release$CounterPerformanceQuery
                                                                                                                                                                • String ID: ..\..\third_party\libc++\src\include\optional:801: assertion this->has_value() failed: optional operator* called on a disengaged value$<
                                                                                                                                                                • API String ID: 593636287-161334329
                                                                                                                                                                • Opcode ID: 84358a583a8864861a3835725e88becf1572dd4ac1868fae364640ee7a346891
                                                                                                                                                                • Instruction ID: f63c6e306b4523108e630d056f8bc4f3a127529b24735598694dfd1d31ebf734
                                                                                                                                                                • Opcode Fuzzy Hash: 84358a583a8864861a3835725e88becf1572dd4ac1868fae364640ee7a346891
                                                                                                                                                                • Instruction Fuzzy Hash: A6C1CB22A0DA46A0EB719B31E55037933A2EF85F90F2546B3DE4E97791DF3DE1828300
                                                                                                                                                                Function 00007FF69100A8B0 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 176threadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CurrentThread$CompletionEventPostQueuedStatus
                                                                                                                                                                • String ID: Chrome.MessageLoopProblem.COMPLETION_POST_ERROR$Chrome.MessageLoopProblem.MESSAGE_POST_ERROR$I$ScheduleWork$ScheduleWorkToSelf$WaitableEvent::Signal
                                                                                                                                                                • API String ID: 3823919964-1721350857
                                                                                                                                                                • Opcode ID: 1b2e5bd49eb9ae20bf0154d17b37f86f4cb7927887b958341e87202b8b3ab7e5
                                                                                                                                                                • Instruction ID: 6df5aaa3fe5508946cb9e85872d69d0c23474a70c5a23f3a35b5e1aa1e419c7c
                                                                                                                                                                • Opcode Fuzzy Hash: 1b2e5bd49eb9ae20bf0154d17b37f86f4cb7927887b958341e87202b8b3ab7e5
                                                                                                                                                                • Instruction Fuzzy Hash: 2D81AC32B0CA4295FB318F25E4503BA77A1FB56784F6440B6DA8D877A4EF2EE146C700
                                                                                                                                                                Function 00007FF690F5D8E0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 217COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExclusiveLock$Init_thread_header$AcquireRelease
                                                                                                                                                                • String ID: ..\..\base\threading\scoped_blocking_call_internal.cc$MonitorNextJankWindowIfNecessary
                                                                                                                                                                • API String ID: 2331409060-733433259
                                                                                                                                                                • Opcode ID: b2ae5955f777f8196748121c7ea5aeaca824905e44a9434e4d135045f73c746c
                                                                                                                                                                • Instruction ID: de68bbd78e44a171c3e96393eb78001560d38274cfd20025431e0e6e72422507
                                                                                                                                                                • Opcode Fuzzy Hash: b2ae5955f777f8196748121c7ea5aeaca824905e44a9434e4d135045f73c746c
                                                                                                                                                                • Instruction Fuzzy Hash: 93A14835A1E646A2FB319B24E8547B932A1EB407A0F6186B1CD2DC37E1DE3DE646C340
                                                                                                                                                                Function 00007FF690F00A46 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 155libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressCurrentDirectoryLibraryLoadParametersProcProcessShutdown
                                                                                                                                                                • String ID: ..\..\chrome\app\main_dll_loader_win.cc$ChromeMain$Failed to load Chrome DLL from $no-pre-read-main-dll
                                                                                                                                                                • API String ID: 4180520086-3232293009
                                                                                                                                                                • Opcode ID: 2573c09bc04f86c012beb044bd65e32b5341038023519f3e5442850348cd59dd
                                                                                                                                                                • Instruction ID: 5b619d3ca9d76ea7916328f40f7f62af0662794d018fbb20a98f4313a9860144
                                                                                                                                                                • Opcode Fuzzy Hash: 2573c09bc04f86c012beb044bd65e32b5341038023519f3e5442850348cd59dd
                                                                                                                                                                • Instruction Fuzzy Hash: DD719122A0CA82A0FB319B25E0553BAA361FF85B94F5045B1EE8DC7BD6DE7DE145C700
                                                                                                                                                                Function 00007FF690FE3ED0 Relevance: 15.2, APIs: 10, Instructions: 212COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00007FF690EFBA57), ref: 00007FF690FE3F6C
                                                                                                                                                                • WakeAllConditionVariable.KERNEL32(?,?,?,?,00007FF690EFBA57), ref: 00007FF690FE3F7E
                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,00007FF690EFBA57), ref: 00007FF690FE3F87
                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00007FF690EFBA57), ref: 00007FF690FE3F90
                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,00007FF690EFBA57), ref: 00007FF690FE3FBC
                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00007FF690EFBA57), ref: 00007FF690FE4019
                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,00007FF690EFBA57), ref: 00007FF690FE4033
                                                                                                                                                                • AcquireSRWLockExclusive.KERNEL32(?,?,?,?,00007FF690EFBA57), ref: 00007FF690FE407B
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExclusiveLock$Acquire$Release$ConditionVariableWake
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2824607059-0
                                                                                                                                                                • Opcode ID: 9576c3ede9a8b709ac08db7acf495cea26bcbb6fe64faa24d93723fdb24f170d
                                                                                                                                                                • Instruction ID: e74425e55793910668eb42a7cde21fff5062cd516a1325e31c818c42aa4f40e9
                                                                                                                                                                • Opcode Fuzzy Hash: 9576c3ede9a8b709ac08db7acf495cea26bcbb6fe64faa24d93723fdb24f170d
                                                                                                                                                                • Instruction Fuzzy Hash: B181A222E0D643A6EF769F25E8443792360EF91B95F1408B5DE1E877A4CF3DF9869200
                                                                                                                                                                Function 00007FF690F07C80 Relevance: 15.2, APIs: 10, Instructions: 169COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExclusiveLock$Acquire$Release$ConditionVariableWake
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2824607059-0
                                                                                                                                                                • Opcode ID: 1328569cd1fe373686ce7e8ff50c24dbd4eb1d202a86e732f4daff5ed15b2c11
                                                                                                                                                                • Instruction ID: 30769d64f5f12113d07628319436c58e9b6d35c04f102f3baca1669fb72593b4
                                                                                                                                                                • Opcode Fuzzy Hash: 1328569cd1fe373686ce7e8ff50c24dbd4eb1d202a86e732f4daff5ed15b2c11
                                                                                                                                                                • Instruction Fuzzy Hash: E4518E21E1E703A2EA759B26D8046792371EF95B95F6549F1CD0E877A0CE3DE9C6C200
                                                                                                                                                                Function 00007FF690EF1960 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 112COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExclusiveLock$Acquire$Release
                                                                                                                                                                • String ID: ..\..\base\task\sequence_manager\work_tracker.cc$E$ScopedAllowBaseSyncPrimitivesOutsideBlockingScope$WaitNoSyncWork
                                                                                                                                                                • API String ID: 1678258262-2415033031
                                                                                                                                                                • Opcode ID: d3eef98db76e4b1b54d6c682860f91a7b786449db0b37969108514a14e156ebb
                                                                                                                                                                • Instruction ID: 502047ee91567fef5d23ce8e28e1ff5ac25218f3a2dcaf8c1278056862373934
                                                                                                                                                                • Opcode Fuzzy Hash: d3eef98db76e4b1b54d6c682860f91a7b786449db0b37969108514a14e156ebb
                                                                                                                                                                • Instruction Fuzzy Hash: 1451A131A0DB8AA1EB308B25F4503BA73A8FB85794F5041B6DA9D87795DF3DE14AC700
                                                                                                                                                                Function 00007FF690F0F7C0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 110COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CriticalEnterInit_thread_headerSection
                                                                                                                                                                • String ID: ..\..\base\metrics\persistent_sample_map.cc$CreatePersistentRecord$PersistentSampleMap-corrupted$corrupt=$false$true
                                                                                                                                                                • API String ID: 956302983-3936605929
                                                                                                                                                                • Opcode ID: 85e20840edc57a2b9d2fc392b2e2f45cd4202c284a1fdf417277c7645f4883be
                                                                                                                                                                • Instruction ID: 194817875a661eb77c0cc24f28ef580debbced1a1de16b412038ce0d381b943e
                                                                                                                                                                • Opcode Fuzzy Hash: 85e20840edc57a2b9d2fc392b2e2f45cd4202c284a1fdf417277c7645f4883be
                                                                                                                                                                • Instruction Fuzzy Hash: C9416131B1C60761FB20DB22A8611BA6791EF84BD0FA084B1DD4DC7B96DE3DE546C740
                                                                                                                                                                Function 00007FF691068E14 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                • String ID: MZx$api-ms-
                                                                                                                                                                • API String ID: 2559590344-259127448
                                                                                                                                                                • Opcode ID: dd4cc9542d3f3c14c11e9e342f8a3624f10ebea0324c018b60d5f0da7bd0974c
                                                                                                                                                                • Instruction ID: 94a0cb1b74f0551b4909c25e1e6d7d47f5ce6292fc2014d156c82653eaf6e1a4
                                                                                                                                                                • Opcode Fuzzy Hash: dd4cc9542d3f3c14c11e9e342f8a3624f10ebea0324c018b60d5f0da7bd0974c
                                                                                                                                                                • Instruction Fuzzy Hash: 62312E21B1AB46A1EF71DB16A8015753394FF45BE4F694AB6EE1D8B784DF3CE4818300
                                                                                                                                                                Function 00007FF69104E378 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _invalid_parameter_noinfo
                                                                                                                                                                • String ID: f$p$p
                                                                                                                                                                • API String ID: 3215553584-1995029353
                                                                                                                                                                • Opcode ID: 068f76d0f18b890415edbbee459f6085b03b5b009f55f171f5f54c5d952db9f8
                                                                                                                                                                • Instruction ID: 280f4923a160a3ca8a13ec6c8797c920da408761cbbc6ccff293e281af9d00c4
                                                                                                                                                                • Opcode Fuzzy Hash: 068f76d0f18b890415edbbee459f6085b03b5b009f55f171f5f54c5d952db9f8
                                                                                                                                                                • Instruction Fuzzy Hash: C212A266F0C14386FB709B14E2946797EA1FB60750FA84075E699876C4FF3EE8909B00
                                                                                                                                                                Function 00007FF69105AB54 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Value$ErrorLast
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2506987500-0
                                                                                                                                                                • Opcode ID: a66d844107d4f14a5268baed5a3b58142ee65e15a45b416e0e66d6ec62954b37
                                                                                                                                                                • Instruction ID: 73d4e1694d74542dd7b5a3d9cf9fd1361aa9e9feceb5dcc9838127cc0bd60f9d
                                                                                                                                                                • Opcode Fuzzy Hash: a66d844107d4f14a5268baed5a3b58142ee65e15a45b416e0e66d6ec62954b37
                                                                                                                                                                • Instruction Fuzzy Hash: 83215E20B0D24682FB78672255552796293EF447F4F340FB4ED3EC66C6DE3EB5428640
                                                                                                                                                                Function 00007FF690F04490 Relevance: 9.3, APIs: 6, Instructions: 344COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExclusiveLock$Acquire$Release
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1678258262-0
                                                                                                                                                                • Opcode ID: 1a2d31d5387c60592c12b754f5a317346152e36f52676057c0b26346e4e6b45b
                                                                                                                                                                • Instruction ID: 5dc207ddb2c436fa1d1d219b64067f68b24b5e26af7bd1827abae85690cb9a0f
                                                                                                                                                                • Opcode Fuzzy Hash: 1a2d31d5387c60592c12b754f5a317346152e36f52676057c0b26346e4e6b45b
                                                                                                                                                                • Instruction Fuzzy Hash: DCF1A076A0CA81A2EB718B25E0543BA67B0FF85B90F5444B1DE8D87B95DF3CE646C700
                                                                                                                                                                Function 00007FF690F0F3F0 Relevance: 9.0, APIs: 6, Instructions: 50threadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Thread$Priority$Current$Information
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2516384554-0
                                                                                                                                                                • Opcode ID: 03eb504fb67f90c1c101526385660f621b6b92e8a519c8b8c8ffdc238a5c7abb
                                                                                                                                                                • Instruction ID: 110653ab480c599883a1b517a52bf69b577ccd3bfc7d1d561380b8c341adc412
                                                                                                                                                                • Opcode Fuzzy Hash: 03eb504fb67f90c1c101526385660f621b6b92e8a519c8b8c8ffdc238a5c7abb
                                                                                                                                                                • Instruction Fuzzy Hash: 7911CE31E1C65292EB309B35E94426E22B0EF99BA0FA046B0DD4E83794DE3CE947C300
                                                                                                                                                                Function 00007FF690EF11F0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 257threadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                • ..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at, xrefs: 00007FF690EF159C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExclusiveLock$Acquire$CurrentReleaseThread
                                                                                                                                                                • String ID: ..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at
                                                                                                                                                                • API String ID: 1385397084-2888085009
                                                                                                                                                                • Opcode ID: 61c07695206875df22f660a3059454f14a40856f90c5501b2d9f4065aa9320b4
                                                                                                                                                                • Instruction ID: 477c61baafed5ab3624fcfad43dc0b977e978e343ce5bc6abc63fc41de0c8bca
                                                                                                                                                                • Opcode Fuzzy Hash: 61c07695206875df22f660a3059454f14a40856f90c5501b2d9f4065aa9320b4
                                                                                                                                                                • Instruction Fuzzy Hash: 51B1B222A09B46A1EB30DF22E44427967A8FB88BD4F5545B6DF5E87791DF3CE181E300
                                                                                                                                                                Function 00007FF690EF43DE Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 194COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                • ..\..\third_party\libc++\src\include\vector:1411: assertion __n < size() failed: vector[] index out of bounds, xrefs: 00007FF690EF45F6
                                                                                                                                                                • ..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at, xrefs: 00007FF690EF4609
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExclusiveLock$AcquireRelease
                                                                                                                                                                • String ID: ..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at$..\..\third_party\libc++\src\include\vector:1411: assertion __n < size() failed: vector[] index out of bounds
                                                                                                                                                                • API String ID: 17069307-112411280
                                                                                                                                                                • Opcode ID: d33228ed1969e71a855f194de7a47776dc611d6b31a8d9e5a6941455c78e46fe
                                                                                                                                                                • Instruction ID: f080ae8b53c05b6140c281396877b64462d200bea6ea3b04f151c2b773e7348b
                                                                                                                                                                • Opcode Fuzzy Hash: d33228ed1969e71a855f194de7a47776dc611d6b31a8d9e5a6941455c78e46fe
                                                                                                                                                                • Instruction Fuzzy Hash: 2D719062A08A45A3EB35EF26E44127963A4FF84B90F5505B1DB9E877A4DF3CE482D300
                                                                                                                                                                Function 00007FF690FECFD0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 188fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                • ..\..\third_party\libc++\src\include\__string\char_traits.h:223: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 00007FF690FED13C
                                                                                                                                                                • SharedMemoryTracker, xrefs: 00007FF690FED275
                                                                                                                                                                • ..\..\third_party\libc++\src\include\optional:806: assertion this->has_value() failed: optional operator* called on a disengaged value, xrefs: 00007FF690FED2B3
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileInit_thread_headerUnmapView
                                                                                                                                                                • String ID: ..\..\third_party\libc++\src\include\__string\char_traits.h:223: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$..\..\third_party\libc++\src\include\optional:806: assertion this->has_value() failed: optional operator* called on a disengaged value$SharedMemoryTracker
                                                                                                                                                                • API String ID: 3127146094-4112981607
                                                                                                                                                                • Opcode ID: 4a457acc1c41ae7382372068683e3753ce266708724b6ac96c6cda43378fd6f6
                                                                                                                                                                • Instruction ID: bf2b2d98dc0a83a942360c4f16dfada0e12712661afae2e8e611ac95df8a6b0a
                                                                                                                                                                • Opcode Fuzzy Hash: 4a457acc1c41ae7382372068683e3753ce266708724b6ac96c6cda43378fd6f6
                                                                                                                                                                • Instruction Fuzzy Hash: 9071A222A0D646A5FB309B21E9443B92360FB417A4F544671DE1D87BE1EF7DE146C300
                                                                                                                                                                Function 00007FF69105FD8C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 167COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLastNameTranslate$CodePageValidValue
                                                                                                                                                                • String ID: utf8
                                                                                                                                                                • API String ID: 1791977518-905460609
                                                                                                                                                                • Opcode ID: c922daf9118beca38ec432b48f46a14d629789ec4195183bd69ca4ff8b666f58
                                                                                                                                                                • Instruction ID: 9c5d499c4f61db286aaf2cf36934847b135a94c6df009de470c7f14088e8f3db
                                                                                                                                                                • Opcode Fuzzy Hash: c922daf9118beca38ec432b48f46a14d629789ec4195183bd69ca4ff8b666f58
                                                                                                                                                                • Instruction Fuzzy Hash: 35619D32A0874681FB74AB2294006B962A5EF45B84F2445B1DE1CC7BC6EF3EE991D341
                                                                                                                                                                Function 00007FF690F619B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 126COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                • ..\..\third_party\libc++\src\include\string_view:316: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 00007FF690F61A65
                                                                                                                                                                • ..\..\third_party\libc++\src\include\string_view:314: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 00007FF690F61A52
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExclusiveLock$Acquire$Concurrency::cancel_current_taskRelease
                                                                                                                                                                • String ID: ..\..\third_party\libc++\src\include\string_view:314: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:316: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr
                                                                                                                                                                • API String ID: 2092680701-3440194742
                                                                                                                                                                • Opcode ID: da32af2e6bc8a365c075913c32342db3806eadd23df2d14e60c24730e9268893
                                                                                                                                                                • Instruction ID: 0d5bce137137588a37db854b660d6c2367cf4ff5bd391eb41e0717838fc6e278
                                                                                                                                                                • Opcode Fuzzy Hash: da32af2e6bc8a365c075913c32342db3806eadd23df2d14e60c24730e9268893
                                                                                                                                                                • Instruction Fuzzy Hash: 2241CE61A0CB8691EB259B21E8502BA7365FF89FD0F5481B1EE4D87755CF3CE192C700
                                                                                                                                                                Function 00007FF690EF16D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                • ..\..\third_party\libc++\src\include\array:234: assertion __n < _Size failed: out-of-bounds access in std::array<T, N>, xrefs: 00007FF690EF180C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExclusiveLock$Acquire$Release
                                                                                                                                                                • String ID: ..\..\third_party\libc++\src\include\array:234: assertion __n < _Size failed: out-of-bounds access in std::array<T, N>
                                                                                                                                                                • API String ID: 1678258262-2696940747
                                                                                                                                                                • Opcode ID: 5c4a98dc9552a91ca090eebdb496570c6e9dc948cd287dc56b7a0551edf72590
                                                                                                                                                                • Instruction ID: 71e24def11181dcc88e3e9faa8126e4087350122d21e64b569bcf1ab729f8fb7
                                                                                                                                                                • Opcode Fuzzy Hash: 5c4a98dc9552a91ca090eebdb496570c6e9dc948cd287dc56b7a0551edf72590
                                                                                                                                                                • Instruction Fuzzy Hash: A041B316B09685A1EB78AB32A5446B9679CFB96B80F5844F6CF0D873C1DF3CE496D300
                                                                                                                                                                Function 00007FF690F39290 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 109COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00007FF690FB5770: QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF690FB58BA
                                                                                                                                                                  • Part of subcall function 00007FF690FB5770: TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF690FB591A
                                                                                                                                                                • GetLongPathNameW.KERNEL32 ref: 00007FF690F3932D
                                                                                                                                                                • GetLongPathNameW.KERNEL32 ref: 00007FF690F3936C
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: LongNamePath$AcquireCounterExclusiveLockPerformanceQuery
                                                                                                                                                                • String ID: ..\..\base\files\file_util_win.cc$MakeLongFilePath$ScopedBlockingCall
                                                                                                                                                                • API String ID: 229450574-2989128051
                                                                                                                                                                • Opcode ID: c312525613be4cd16aa4d7f72e1cd938af422d83c6ca36a45156356376286679
                                                                                                                                                                • Instruction ID: dc4ee57b63f6a473dfc37c478f00211338fe63bd77e66a364684b46468942622
                                                                                                                                                                • Opcode Fuzzy Hash: c312525613be4cd16aa4d7f72e1cd938af422d83c6ca36a45156356376286679
                                                                                                                                                                • Instruction Fuzzy Hash: 7F41B022A1CB8261FB31CB25E5507BA63A0FF89B94F144171EE8C83755EF3CE2868741
                                                                                                                                                                Function 00007FF690EFB370 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressInit_thread_headerLibraryLoadProc
                                                                                                                                                                • String ID: ProcessPrng$bcryptprimitives.dll
                                                                                                                                                                • API String ID: 1459703600-2667675608
                                                                                                                                                                • Opcode ID: 7986b5dbea1b74029f1dd08eea236bee2da980835428610ad87e5f1fe2b1fa1c
                                                                                                                                                                • Instruction ID: 4438b708f6bdfabeebb7fa7931718aae0e56dbb3bc991b391a40e83d9b3cce6e
                                                                                                                                                                • Opcode Fuzzy Hash: 7986b5dbea1b74029f1dd08eea236bee2da980835428610ad87e5f1fe2b1fa1c
                                                                                                                                                                • Instruction Fuzzy Hash: 6C419F21E0DA46A1FB319B25F9412B96765EF84BD0F6045B1DE4C837A5EF3DE5828300
                                                                                                                                                                Function 00007FF690F0D350 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                • ..\..\third_party\libc++\src\include\vector:618: assertion !empty() failed: front() called on an empty vector, xrefs: 00007FF690F0D474
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExclusiveLock$Acquire$CounterPerformanceQueryRelease
                                                                                                                                                                • String ID: ..\..\third_party\libc++\src\include\vector:618: assertion !empty() failed: front() called on an empty vector
                                                                                                                                                                • API String ID: 743314926-3459903379
                                                                                                                                                                • Opcode ID: 99a252b5d465f9301fe4fc8a60811eca582b1fa225a2961a7a20568c248e0683
                                                                                                                                                                • Instruction ID: 7fcdcb03c0ffe20c0db767219ade9244149396a347a9c7df88c8f17a5a6ed20b
                                                                                                                                                                • Opcode Fuzzy Hash: 99a252b5d465f9301fe4fc8a60811eca582b1fa225a2961a7a20568c248e0683
                                                                                                                                                                • Instruction Fuzzy Hash: BA315E25A0DB46A1EB74CB25E5803796371EB84B90F9415B2DE4E87B60CF7CF586C301
                                                                                                                                                                Function 00007FF690FEBAB0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 75libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FF690FEBB8F
                                                                                                                                                                • GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FF690FEBB9F
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressHandleModuleProc
                                                                                                                                                                • String ID: ..\..\base\files\file_win.cc$Close$GetHandleVerifier
                                                                                                                                                                • API String ID: 1646373207-1682205630
                                                                                                                                                                • Opcode ID: 52f64652c8bd0cf0fe02aa6770194f51bec0dbf93c75cdbff5a995bad9131fdf
                                                                                                                                                                • Instruction ID: dbf3c9c8bf9ad84b6d417173de55cfe2741fce03becf6a97eae3c61240351fab
                                                                                                                                                                • Opcode Fuzzy Hash: 52f64652c8bd0cf0fe02aa6770194f51bec0dbf93c75cdbff5a995bad9131fdf
                                                                                                                                                                • Instruction Fuzzy Hash: F8319C21A0CA46A0FB359B39E5553BA6362FF80B84F5044B1CD4E837A4DE3DE28AC300
                                                                                                                                                                Function 00007FF691046324 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                • API String ID: 4061214504-1276376045
                                                                                                                                                                • Opcode ID: 32e9c879e804497b56d002a723e7c23f8272a6a0631c2a129262b98cd42691ce
                                                                                                                                                                • Instruction ID: 099a00a19faa4e3c117b9d4ef9e584674b452c9acc66729bde3b1179d5c47635
                                                                                                                                                                • Opcode Fuzzy Hash: 32e9c879e804497b56d002a723e7c23f8272a6a0631c2a129262b98cd42691ce
                                                                                                                                                                • Instruction Fuzzy Hash: 6DF0C861A1960691EB304B24E4843792370EF457A1FA44775D56E862F4DF3DD445C700
                                                                                                                                                                Function 00007FF690EFE100 Relevance: 7.7, APIs: 5, Instructions: 172COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 6d640bd5a575a80da2b7c96e6d8d4cee3951ee5eb7b4e857b1dc6c25ca32e91c
                                                                                                                                                                • Instruction ID: 2df9792f035ec57f74ec9c58d2c6eaa9ba3332bcc48c5ef1e1d2422e54b5b99d
                                                                                                                                                                • Opcode Fuzzy Hash: 6d640bd5a575a80da2b7c96e6d8d4cee3951ee5eb7b4e857b1dc6c25ca32e91c
                                                                                                                                                                • Instruction Fuzzy Hash: D161A031E0A646E1FB348B25E9402783365EB88BA0F6446B1EA2D877E4DE3DF446D700
                                                                                                                                                                Function 00007FF691046078 Relevance: 7.6, APIs: 5, Instructions: 60threadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2067211477-0
                                                                                                                                                                • Opcode ID: abc3e783a04faf45aa8494dd57c5f0cfd78af8acb2501e7cbfc24410e1899432
                                                                                                                                                                • Instruction ID: 6499eaf8c0d9195fcc8b06aa5ed1968194f1fd5f8159f43a6851b72ca61c0f53
                                                                                                                                                                • Opcode Fuzzy Hash: abc3e783a04faf45aa8494dd57c5f0cfd78af8acb2501e7cbfc24410e1899432
                                                                                                                                                                • Instruction Fuzzy Hash: 8D219535A0974286EF64DF51A49007AA3A0FF94BC0FA84571EE8D837A6FF3DE4418700
                                                                                                                                                                Function 00007FF69106236C Relevance: 7.6, APIs: 5, Instructions: 56COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _set_statfp
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1156100317-0
                                                                                                                                                                • Opcode ID: 3a671f99ee0fb86fe5a3f1c0d9c68e80201ce987232c96135fb73765a972c590
                                                                                                                                                                • Instruction ID: e073cb0922607dddb487ae4eb33f29b5413595316325ad39fdf918dbe6e22624
                                                                                                                                                                • Opcode Fuzzy Hash: 3a671f99ee0fb86fe5a3f1c0d9c68e80201ce987232c96135fb73765a972c590
                                                                                                                                                                • Instruction Fuzzy Hash: 0011CA22E1CA2F41F7781528E5423793041EF593F0F35C7B5EA6EC62DA8F6E68C19204
                                                                                                                                                                Function 00007FF69105AD94 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Value
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3702945584-0
                                                                                                                                                                • Opcode ID: cf653522b8b69c6b3aad77a09eb3b47f5dc48a534566c70a9d1cfe3f748af2df
                                                                                                                                                                • Instruction ID: 6838548c2596530919666b6cd3e26e0fded5ae0da2f3867b057791a13446e37c
                                                                                                                                                                • Opcode Fuzzy Hash: cf653522b8b69c6b3aad77a09eb3b47f5dc48a534566c70a9d1cfe3f748af2df
                                                                                                                                                                • Instruction Fuzzy Hash: 59114C21A0924281FB78B72355552796282EF453F4F784BB5E83EC66DAEE3EF5029600
                                                                                                                                                                Function 00007FF69105AC28 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Value
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3702945584-0
                                                                                                                                                                • Opcode ID: b5b251b011f527d407d21a620073db39fc5ab5114de0ed978a0b912cfe9ad912
                                                                                                                                                                • Instruction ID: f47ba51fa516935524a26d1c2431a6f489ae19952f766479bf5bf140bc80af78
                                                                                                                                                                • Opcode Fuzzy Hash: b5b251b011f527d407d21a620073db39fc5ab5114de0ed978a0b912cfe9ad912
                                                                                                                                                                • Instruction Fuzzy Hash: 3611EF10A0910B42FB78A32345655B52682EF45374F384BB4E93EC62D6ED3EB5024510
                                                                                                                                                                Function 00007FF691099B40 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 156COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExclusiveLock$Acquire$Release
                                                                                                                                                                • String ID: <
                                                                                                                                                                • API String ID: 1678258262-4251816714
                                                                                                                                                                • Opcode ID: a0cee02e1bdeef71f621d0d697b4f4436e2e95d55743dbb77dce8cf76cc337aa
                                                                                                                                                                • Instruction ID: 0314f8e224e0174a628877e91be04403514cb303b0f4bb4e93ca6d67b19129ec
                                                                                                                                                                • Opcode Fuzzy Hash: a0cee02e1bdeef71f621d0d697b4f4436e2e95d55743dbb77dce8cf76cc337aa
                                                                                                                                                                • Instruction Fuzzy Hash: 5D51F561E0D94A84FB36AB219A7027D6361EF45BD0F7446B1DD1FA7395EF3DE0928200
                                                                                                                                                                Function 00007FF690F604C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 91COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00007FF690FB5770: QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF690FB58BA
                                                                                                                                                                  • Part of subcall function 00007FF690FB5770: TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF690FB591A
                                                                                                                                                                • GetCurrentDirectoryW.KERNEL32 ref: 00007FF690F6056C
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AcquireCounterCurrentDirectoryExclusiveLockPerformanceQuery
                                                                                                                                                                • String ID: ..\..\base\files\file_util_win.cc$GetCurrentDirectoryW$ScopedBlockingCall
                                                                                                                                                                • API String ID: 1780455465-3482229333
                                                                                                                                                                • Opcode ID: 74892bfa652e4ac8263c05ca51ecc3e51736e83ef517a43106ce56af40c3d85b
                                                                                                                                                                • Instruction ID: 6b6743daa4e4cbbb59a2b1ee6a239186051923d7fa9e030af506b36eb44311b6
                                                                                                                                                                • Opcode Fuzzy Hash: 74892bfa652e4ac8263c05ca51ecc3e51736e83ef517a43106ce56af40c3d85b
                                                                                                                                                                • Instruction Fuzzy Hash: 9C416C22A0CA86A0FB319B25E4547EAB360EF81784F545071EE8D87759DE3DE286C740
                                                                                                                                                                Function 00007FF690EF9060 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 76COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExclusiveLock$AcquireRelease
                                                                                                                                                                • String ID: bitset set argument out of range$bitset test argument out of range
                                                                                                                                                                • API String ID: 17069307-1976194836
                                                                                                                                                                • Opcode ID: 8be63f9d8c657fe10e2af847256240db0aa901604887d140b188e7038d34bc44
                                                                                                                                                                • Instruction ID: d5280373aa8575a338448158a2041c56dc5ca1f139dce5edb6bdaaf096c46e81
                                                                                                                                                                • Opcode Fuzzy Hash: 8be63f9d8c657fe10e2af847256240db0aa901604887d140b188e7038d34bc44
                                                                                                                                                                • Instruction Fuzzy Hash: B821D362B0A64762FE749B62F6547F9129ADB547C0E5040B2CF8E83B81DE6CE085D304
                                                                                                                                                                Function 00007FF690F006A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressErrorHandleLastModuleProc
                                                                                                                                                                • String ID: GetHandleVerifier
                                                                                                                                                                • API String ID: 4275029093-1090674830
                                                                                                                                                                • Opcode ID: 4bf53a069016684f93c5922eb2d92305a55529040911f6076e77187bd334e567
                                                                                                                                                                • Instruction ID: aece913eab5596aacd5c8205a854b2ac2bed7794ce5d6a873dfd33634917280f
                                                                                                                                                                • Opcode Fuzzy Hash: 4bf53a069016684f93c5922eb2d92305a55529040911f6076e77187bd334e567
                                                                                                                                                                • Instruction Fuzzy Hash: 81214F36B0DA07A0EB759B25A9442792262EF45790F5088B5CD0E833A1DF7DF597C600
                                                                                                                                                                Function 00007FF690F01110 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55filelibraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • UnmapViewOfFile.KERNEL32(?,?,00000000,?,00007FF690F01291,?,?,?,?,?,?,?,00007FF690F00FE9), ref: 00007FF690F01122
                                                                                                                                                                • GetModuleHandleW.KERNEL32(?,?,00000000,?,00007FF690F01291,?,?,?,?,?,?,?,00007FF690F00FE9), ref: 00007FF690F0118D
                                                                                                                                                                • GetProcAddress.KERNEL32(?,?,00000000,?,00007FF690F01291,?,?,?,?,?,?,?,00007FF690F00FE9), ref: 00007FF690F0119D
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressFileHandleModuleProcUnmapView
                                                                                                                                                                • String ID: GetHandleVerifier
                                                                                                                                                                • API String ID: 3224599007-1090674830
                                                                                                                                                                • Opcode ID: 9d509a4535ab0a042a9a6a23ef4f8eb1ef46c88450bc9c22c9d4caa3c88c973e
                                                                                                                                                                • Instruction ID: 5d0c845792bfd1f58c7c777b0c9d5e93681b8c574623b96e5b88034873cee429
                                                                                                                                                                • Opcode Fuzzy Hash: 9d509a4535ab0a042a9a6a23ef4f8eb1ef46c88450bc9c22c9d4caa3c88c973e
                                                                                                                                                                • Instruction Fuzzy Hash: 13115C34E0DA06A1EB789B35E9852792376FF86B80F5055B1CE0E837A0CF2DE646C200
                                                                                                                                                                Function 00007FF690EFDC29 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 48COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                • ..\..\third_party\libc++\src\include\string_view:316: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 00007FF690EFDCE6
                                                                                                                                                                • ..\..\third_party\libc++\src\include\string_view:314: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 00007FF690EFDCD3
                                                                                                                                                                • LOG_FATAL, xrefs: 00007FF690EFDD0B
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Init_thread_header
                                                                                                                                                                • String ID: ..\..\third_party\libc++\src\include\string_view:314: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:316: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$LOG_FATAL
                                                                                                                                                                • API String ID: 3738618077-3725589571
                                                                                                                                                                • Opcode ID: 728f2887a0d689a7dc6e2607ab88fa97c063a1a186b6805a23b89d0a0eba10d6
                                                                                                                                                                • Instruction ID: d0aebe16d9f63d0c1853da43ddf2d0ded30ec917bc95755863ee13d03dac3441
                                                                                                                                                                • Opcode Fuzzy Hash: 728f2887a0d689a7dc6e2607ab88fa97c063a1a186b6805a23b89d0a0eba10d6
                                                                                                                                                                • Instruction Fuzzy Hash: 0D214634E0DA47A0FB21DB20E85027A7B62EF84790F6042B1DA4DC63A5EE7DF152D700
                                                                                                                                                                Function 00007FF690FB75B0 Relevance: 6.2, APIs: 4, Instructions: 165COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(?,00000001,-7FFFFFFFFFFFFF91,00007FF690FB7511), ref: 00007FF690FB75EA
                                                                                                                                                                • AcquireSRWLockExclusive.KERNEL32(?,00000001,-7FFFFFFFFFFFFF91,00007FF690FB7511), ref: 00007FF690FB76D8
                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69106EC6D
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AcquireExclusiveLock
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4021432409-0
                                                                                                                                                                • Opcode ID: 435ece3567e20806b86528bc46686e689ad5fc74ece91386abce5d223803a762
                                                                                                                                                                • Instruction ID: a112e34f87a25d7989fc86c243cf6a8bf327e9a7a62c43a217335a279adaceaf
                                                                                                                                                                • Opcode Fuzzy Hash: 435ece3567e20806b86528bc46686e689ad5fc74ece91386abce5d223803a762
                                                                                                                                                                • Instruction Fuzzy Hash: F451BB22B09B1A91EB34CF2AE4405796761EB88FE4F654472DE0E87394DE3DE5C2CB40
                                                                                                                                                                Function 00007FF690F0FA70 Relevance: 6.1, APIs: 4, Instructions: 119COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExclusiveLock$Acquire$Init_thread_headerRelease
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3023567774-0
                                                                                                                                                                • Opcode ID: 6b5c33d0de4e58bc117f62e036c6def3e73eb828f772195cab2d2990a447e9d9
                                                                                                                                                                • Instruction ID: 81b5fc546a2a7b3ca6256ad61842d709115b8789a1ca79c7d255f64c6cb70497
                                                                                                                                                                • Opcode Fuzzy Hash: 6b5c33d0de4e58bc117f62e036c6def3e73eb828f772195cab2d2990a447e9d9
                                                                                                                                                                • Instruction Fuzzy Hash: 2E518B62A0D606A2EB759B25D9503783370FB84B90F6445F2CE1D83BA1CF3CE69A8700
                                                                                                                                                                Function 00007FF690EF8590 Relevance: 6.1, APIs: 4, Instructions: 62COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExclusiveLock$AcquireRelease
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 17069307-0
                                                                                                                                                                • Opcode ID: 21530a1a1e7de65fd0dab029c457be5b91a17ba8b37af2841097ad05aef8646d
                                                                                                                                                                • Instruction ID: 78836b7cb421277bfb52b7f4daf479d4b35140fbc1b8f10354731316cab567f0
                                                                                                                                                                • Opcode Fuzzy Hash: 21530a1a1e7de65fd0dab029c457be5b91a17ba8b37af2841097ad05aef8646d
                                                                                                                                                                • Instruction Fuzzy Hash: 0B213032A09A5AA5EB618F16FD506B823A0FB01BF4F604671CE7D867E0DF3D9186D304
                                                                                                                                                                Function 00007FF690FD4E80 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 163COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,00007FF690FBF9F9,?,?,?,?,00007FF690FBF10F), ref: 00007FF690FD4EB8
                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(-0000000400000000,?,?,?,?,?,00007FF690FBF9F9,?,?,?,?,00007FF690FBF10F), ref: 00007FF690FD4F1A
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExclusiveLock$AcquireRelease
                                                                                                                                                                • String ID: first
                                                                                                                                                                • API String ID: 17069307-2456940119
                                                                                                                                                                • Opcode ID: da8a67de79326e0f30b7bfd55a604d43b9ab41438eb46c16672bc25c08cfd618
                                                                                                                                                                • Instruction ID: cd67fba12b4c3435e5822139d625a6779c8ab8ff59be5fc90ac22c5014b5ce61
                                                                                                                                                                • Opcode Fuzzy Hash: da8a67de79326e0f30b7bfd55a604d43b9ab41438eb46c16672bc25c08cfd618
                                                                                                                                                                • Instruction Fuzzy Hash: 15512922A0C692A2FB358B26E44477E2791EF55B98F1485B2DE4D873D0DF3DE582D340
                                                                                                                                                                Function 00007FF690F1D0C0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 102COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                • , xrefs: 00007FF690F1D103
                                                                                                                                                                • ..\..\third_party\libc++\src\include\__string\char_traits.h:146: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 00007FF690F1D272
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Init_thread_header
                                                                                                                                                                • String ID: $..\..\third_party\libc++\src\include\__string\char_traits.h:146: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap
                                                                                                                                                                • API String ID: 3738618077-1438114134
                                                                                                                                                                • Opcode ID: 22fc978e3a1f66e8004add8da9dcb6ab5592476a7bec073728e67ac8b31c4510
                                                                                                                                                                • Instruction ID: 18163bcb3ffd088d0ed3f6a3a858bae80fa4f700dfced76d6d88b0b50b60fbbe
                                                                                                                                                                • Opcode Fuzzy Hash: 22fc978e3a1f66e8004add8da9dcb6ab5592476a7bec073728e67ac8b31c4510
                                                                                                                                                                • Instruction Fuzzy Hash: 4C41B271A0DA86A1FB21CB24E9413B97760EF947D4F644271DD8DC3661DF3EE1828700
                                                                                                                                                                Function 00007FF690EF1870 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                • ..\..\third_party\libc++\src\include\array:234: assertion __n < _Size failed: out-of-bounds access in std::array<T, N>, xrefs: 00007FF690EF1935
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AcquireExclusiveLock
                                                                                                                                                                • String ID: ..\..\third_party\libc++\src\include\array:234: assertion __n < _Size failed: out-of-bounds access in std::array<T, N>
                                                                                                                                                                • API String ID: 4021432409-2696940747
                                                                                                                                                                • Opcode ID: 02eab346ddad830e06adcacfe6aabfcb5fa2758afeab2ba89664025e20f7a39d
                                                                                                                                                                • Instruction ID: 30a9cb9e536a6840fa1e0903e22f38edf52b3a3d48aeea639da14f0ff69289b5
                                                                                                                                                                • Opcode Fuzzy Hash: 02eab346ddad830e06adcacfe6aabfcb5fa2758afeab2ba89664025e20f7a39d
                                                                                                                                                                • Instruction Fuzzy Hash: A221D111F0D28A70FE798B72666057C1BACEF95B88F1844F2CF0D937918E6CE592A340
                                                                                                                                                                Function 00007FF690F28280 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                • unknown, xrefs: 00007FF690F282F0, 00007FF690F28313
                                                                                                                                                                • ..\..\third_party\libc++\src\include\__string\char_traits.h:146: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 00007FF690F283D2
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FrequencyPerformanceQuery
                                                                                                                                                                • String ID: ..\..\third_party\libc++\src\include\__string\char_traits.h:146: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$unknown
                                                                                                                                                                • API String ID: 4204123506-4247734868
                                                                                                                                                                • Opcode ID: 2a299e6bb25d15a9ef8b1b7abf36f57da920036a689266d1a52730244a680ec9
                                                                                                                                                                • Instruction ID: 6048759c753cec0900d22fc7513e3ae4bda16f45ad0a6f240f9628661c39b3d9
                                                                                                                                                                • Opcode Fuzzy Hash: 2a299e6bb25d15a9ef8b1b7abf36f57da920036a689266d1a52730244a680ec9
                                                                                                                                                                • Instruction Fuzzy Hash: 2D418B3290CB8295FB21CB24E4903B973A1FB94744F608175DA8D87765DF7CE586C340
                                                                                                                                                                Function 00007FF690F08700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLast$FileSize
                                                                                                                                                                • String ID: ..\..\base\files\file_win.cc$GetLength
                                                                                                                                                                • API String ID: 3064237074-1822068241
                                                                                                                                                                • Opcode ID: bd00ed68b70afebad02717edd02354b65281e229047a52ef7d88d98de5817d20
                                                                                                                                                                • Instruction ID: 0a43ad573d3ed4a42fc5821998d395d3ed87cc2dfd2109e018885b2b3cf26716
                                                                                                                                                                • Opcode Fuzzy Hash: bd00ed68b70afebad02717edd02354b65281e229047a52ef7d88d98de5817d20
                                                                                                                                                                • Instruction Fuzzy Hash: 1811943170898590FB359B29A9157E9A3B4FF84BC4F505171DE8D87B14DE3DD14B8740
                                                                                                                                                                Function 00007FF690F01060 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00007FF690F01110: UnmapViewOfFile.KERNEL32(?,?,00000000,?,00007FF690F01291,?,?,?,?,?,?,?,00007FF690F00FE9), ref: 00007FF690F01122
                                                                                                                                                                • GetModuleHandleW.KERNEL32(?,?,?,?,00007FF690F00FF9), ref: 00007FF690F010BE
                                                                                                                                                                • GetProcAddress.KERNEL32(?,?,?,?,00007FF690F00FF9), ref: 00007FF690F010CE
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressFileHandleModuleProcUnmapView
                                                                                                                                                                • String ID: GetHandleVerifier
                                                                                                                                                                • API String ID: 3224599007-1090674830
                                                                                                                                                                • Opcode ID: 646ffcecc2f029c0eb01d8804cd92f25d921aa2600a629b9bbab22f6734dd47f
                                                                                                                                                                • Instruction ID: 22fc0fc8f1ad64eda817bf595fa9d0f015fd77f065157240f9697e024e844d97
                                                                                                                                                                • Opcode Fuzzy Hash: 646ffcecc2f029c0eb01d8804cd92f25d921aa2600a629b9bbab22f6734dd47f
                                                                                                                                                                • Instruction Fuzzy Hash: A2112A24F0DA46A1FA349736E9453792276FF46B90F5048B5CD8F837A1CE2DE1868301
                                                                                                                                                                Function 00007FF690F00600 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleW.KERNEL32(?,?,?,?,00007FF690FAEA13,?,?,?,00000000,00007FF690EF1EA3), ref: 00007FF690F00652
                                                                                                                                                                • GetProcAddress.KERNEL32(?,?,?,?,00007FF690FAEA13,?,?,?,00000000,00007FF690EF1EA3), ref: 00007FF690F00662
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressHandleModuleProc
                                                                                                                                                                • String ID: GetHandleVerifier
                                                                                                                                                                • API String ID: 1646373207-1090674830
                                                                                                                                                                • Opcode ID: 5b6f329755341b9085894c393f8fca63078ddd1b8ec7b330fddeaa9731562163
                                                                                                                                                                • Instruction ID: ef0733b814d59973fee39519c0851d65e4fd647d5ca6c679e6f3ac1b15f1bf19
                                                                                                                                                                • Opcode Fuzzy Hash: 5b6f329755341b9085894c393f8fca63078ddd1b8ec7b330fddeaa9731562163
                                                                                                                                                                • Instruction Fuzzy Hash: 9C116122A0DA0BA0FB789B35E5543792362EF85B80F5449B5CC0E837A0CF7EE596C300
                                                                                                                                                                Function 00007FF6910331DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RtlPcToFileHeader.KERNEL32(00007FF69103239F,?,?,?,?,00007FF69102F923), ref: 00007FF691033220
                                                                                                                                                                • RaiseException.KERNEL32(?,?,?,?,00007FF69102F923), ref: 00007FF691033266
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                • String ID: csm
                                                                                                                                                                • API String ID: 2573137834-1018135373
                                                                                                                                                                • Opcode ID: 6fb8c7d8efd1d46303c966a5715d4df45c83813c0029c6b3660b54580419860e
                                                                                                                                                                • Instruction ID: 0b7506be365d94debc52609c87f5ab71430f3e96b1f54614396a928005414a7e
                                                                                                                                                                • Opcode Fuzzy Hash: 6fb8c7d8efd1d46303c966a5715d4df45c83813c0029c6b3660b54580419860e
                                                                                                                                                                • Instruction Fuzzy Hash: 3C117336A08B8192EB218F15F58066977E5FB88B94F684274DF8C47B68DF3DD552CB00
                                                                                                                                                                Function 00007FF6910735C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001E.00000002.2888259444.00007FF690EF1000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FF690EF0000, based on PE: true
                                                                                                                                                                • Associated: 0000001E.00000002.2888101829.00007FF690EF0000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2889102468.00007FF6910EE000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894439577.00007FF691132000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894546887.00007FF691133000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894688950.00007FF691134000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2894925625.00007FF691140000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691141000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691161000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691165000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895173038.00007FF691169000.00000008.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF69116A000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691170000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2895963199.00007FF691173000.00000004.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896296677.00007FF691177000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896423710.00007FF69118D000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896547856.00007FF69118F000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896714372.00007FF691190000.00000020.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF691191000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911BB000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911C4000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911D3000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                • Associated: 0000001E.00000002.2896809480.00007FF6911E7000.00000002.00000001.01000000.00000028.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_30_2_7ff690ef0000_AVGBrowser.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: __std_exception_destroy
                                                                                                                                                                • String ID: Bad variant access$bad_variant_access.cc
                                                                                                                                                                • API String ID: 2453523683-4004146108
                                                                                                                                                                • Opcode ID: b327f99e46e9b856ed6cf6d28e927a13a48c77b2419430039788d3ee51dc1145
                                                                                                                                                                • Instruction ID: 6d88e5804501ac664ad3e824c5ad36834b264d4352a815e10909cb5656f3b346
                                                                                                                                                                • Opcode Fuzzy Hash: b327f99e46e9b856ed6cf6d28e927a13a48c77b2419430039788d3ee51dc1145
                                                                                                                                                                • Instruction Fuzzy Hash: E8E0D115F4851651FB256B1AF8515E42211CF84BD4F7088B1DD0C8B751DD7EA5978300

                                                                                                                                                                Executed Functions

                                                                                                                                                                Function 00777B44 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 0 777b44-777b50 1 777be2-777be5 0->1 2 777b55-777b66 1->2 3 777beb 1->3 5 777b73-777b8c LoadLibraryExW 2->5 6 777b68-777b6b 2->6 4 777bed-777bf1 3->4 9 777bf2-777c02 5->9 10 777b8e-777b97 GetLastError 5->10 7 777b71 6->7 8 777c0b-777c0d 6->8 12 777bdf 7->12 8->4 9->8 11 777c04-777c05 FreeLibrary 9->11 13 777bd0-777bdd 10->13 14 777b99-777bab call 775318 10->14 11->8 12->1 13->12 14->13 17 777bad-777bbf call 775318 14->17 17->13 20 777bc1-777bce LoadLibraryExW 17->20 20->9 20->13
                                                                                                                                                                APIs
                                                                                                                                                                • FreeLibrary.KERNEL32(00000000,?,00777C51,007784B9,?,00000000,00000000,00000000,?,00777DAB,00000021,FlsSetValue,0077EF44,0077EF4C,00000000), ref: 00777C05
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000020.00000002.2885770705.0000000000771000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00770000, based on PE: true
                                                                                                                                                                • Associated: 00000020.00000002.2885647720.0000000000770000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885853163.000000000077D000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885948648.0000000000783000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2886039666.0000000000785000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_32_2_770000_AVGBrowserCrashHandler.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FreeLibrary
                                                                                                                                                                • String ID: api-ms-$ext-ms-
                                                                                                                                                                • API String ID: 3664257935-537541572
                                                                                                                                                                • Opcode ID: c331316935cc4a964d2aa4cdabd082e279dbfc9f8c7a9a99a1031438e9843a92
                                                                                                                                                                • Instruction ID: 2edd89569a5c63409e7f140d1058d9e4bd2b2b89fab488a5aadb7a1cb6a813a3
                                                                                                                                                                • Opcode Fuzzy Hash: c331316935cc4a964d2aa4cdabd082e279dbfc9f8c7a9a99a1031438e9843a92
                                                                                                                                                                • Instruction Fuzzy Hash: 942105B2A08215ABCF369B249C84B5A3368AF417E4F248510F80DA72A0D6BCFD00C6D4
                                                                                                                                                                Function 00779330 Relevance: 7.7, APIs: 5, Instructions: 202COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 21 779330-779349 22 77935f-779364 21->22 23 77934b-77935b call 77a69b 21->23 25 779366-779370 22->25 26 779373-779399 call 776c21 22->26 23->22 29 77935d 23->29 25->26 31 77939f-7793aa 26->31 32 77950c-77951d call 771005 26->32 29->22 34 7793b0-7793b5 31->34 35 7794ff 31->35 38 7793b7-7793c0 call 77cbe0 34->38 39 7793ca-7793d5 call 7775b1 34->39 36 779501 35->36 41 779503-77950a call 777756 36->41 47 7793e0-7793e4 38->47 49 7793c2-7793c8 38->49 46 7793d7 39->46 39->47 41->32 50 7793dd 46->50 47->36 51 7793ea-779401 call 776c21 47->51 49->50 50->47 51->36 54 779407-779419 call 777e1c 51->54 56 77941e-779422 54->56 57 779424-77942c 56->57 58 77943d-77943f 56->58 59 779466-779472 57->59 60 77942e-779433 57->60 58->36 61 779474-779476 59->61 62 7794f1 59->62 63 7794e5-7794e7 60->63 64 779439-77943b 60->64 65 77948b-779496 call 7775b1 61->65 66 779478-779481 call 77cbe0 61->66 67 7794f3-7794fa call 777756 62->67 63->41 64->58 68 779444-77945e call 777e1c 64->68 65->67 79 779498 65->79 66->67 78 779483-779489 66->78 67->58 68->63 77 779464 68->77 77->58 80 77949e-7794a3 78->80 79->80 80->67 81 7794a5-7794bd call 777e1c 80->81 81->67 84 7794bf-7794c6 81->84 85 7794e9-7794ef 84->85 86 7794c8-7794c9 84->86 87 7794ca-7794dc call 776c9d 85->87 86->87 87->67 90 7794de-7794e4 call 777756 87->90 90->63
                                                                                                                                                                APIs
                                                                                                                                                                • __alloca_probe_16.LIBCMT ref: 007793B7
                                                                                                                                                                • __alloca_probe_16.LIBCMT ref: 00779478
                                                                                                                                                                • __freea.LIBCMT ref: 007794DF
                                                                                                                                                                  • Part of subcall function 007775B1: HeapAlloc.KERNEL32(00000000,00776783,007784B9,?,00776783,00000220,?,?,007784B9), ref: 007775E3
                                                                                                                                                                • __freea.LIBCMT ref: 007794F4
                                                                                                                                                                • __freea.LIBCMT ref: 00779504
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000020.00000002.2885770705.0000000000771000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00770000, based on PE: true
                                                                                                                                                                • Associated: 00000020.00000002.2885647720.0000000000770000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885853163.000000000077D000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885948648.0000000000783000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2886039666.0000000000785000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_32_2_770000_AVGBrowserCrashHandler.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: __freea$__alloca_probe_16$AllocHeap
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1096550386-0
                                                                                                                                                                • Opcode ID: c6255a69ba018f45bbdb38f27af27aa750574db7e737704d529ddf74912d5f99
                                                                                                                                                                • Instruction ID: 6610e57397c2e9eb640f91f9cd55bc4beb45e167f0afd92d4eb1bd9b7651f936
                                                                                                                                                                • Opcode Fuzzy Hash: c6255a69ba018f45bbdb38f27af27aa750574db7e737704d529ddf74912d5f99
                                                                                                                                                                • Instruction Fuzzy Hash: 0651C172601256AFEF259F64DC85EBB3AA9EF047D0B198528FE0CD6150F678CC11C7A0
                                                                                                                                                                Function 00774829 Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                • GetCurrentProcess.KERNEL32(0077493C,?,00774823,00000000,?,?,0077493C,F154ADE5,?,0077493C), ref: 0077483A
                                                                                                                                                                • TerminateProcess.KERNEL32(00000000,?,00774823,00000000,?,?,0077493C,F154ADE5,?,0077493C), ref: 00774841
                                                                                                                                                                • ExitProcess.KERNEL32 ref: 00774853
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000020.00000002.2885770705.0000000000771000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00770000, based on PE: true
                                                                                                                                                                • Associated: 00000020.00000002.2885647720.0000000000770000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885853163.000000000077D000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885948648.0000000000783000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2886039666.0000000000785000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_32_2_770000_AVGBrowserCrashHandler.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Process$CurrentExitTerminate
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1703294689-0
                                                                                                                                                                • Opcode ID: f1af53e556f41f6c1dfdeb7b0f9d10fb9c41736dfce5dffec749ec72d15c1cb0
                                                                                                                                                                • Instruction ID: ebb360ce6142728945d2920ca96b1d66b0f09aa34aabdda5b73c880b1af2f06a
                                                                                                                                                                • Opcode Fuzzy Hash: f1af53e556f41f6c1dfdeb7b0f9d10fb9c41736dfce5dffec749ec72d15c1cb0
                                                                                                                                                                • Instruction Fuzzy Hash: CED06C31000148BFCF222FA4EC0D9993F3AFE443D1F00D020B91D9A032CB399D92DA9A
                                                                                                                                                                Function 0077697F Relevance: 3.2, APIs: 2, Instructions: 177COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 100 77697f-7769a7 call 7764af 103 776b6f-776b70 call 776520 100->103 104 7769ad-7769b3 100->104 107 776b75-776b77 103->107 106 7769b6-7769bc 104->106 108 7769c2-7769ce 106->108 109 776abe-776add call 771f40 106->109 111 776b78-776b86 call 771005 107->111 108->106 112 7769d0-7769d6 108->112 117 776ae0-776ae5 109->117 115 776ab6-776ab9 112->115 116 7769dc-7769e8 IsValidCodePage 112->116 115->111 116->115 119 7769ee-7769f5 116->119 120 776ae7-776aec 117->120 121 776b22-776b2c 117->121 122 7769f7-776a03 119->122 123 776a1d-776a2a GetCPInfo 119->123 126 776b1f 120->126 127 776aee-776af6 120->127 121->117 128 776b2e-776b58 call 776471 121->128 129 776a07-776a13 call 776583 122->129 124 776a2c-776a4b call 771f40 123->124 125 776aaa-776ab0 123->125 124->129 140 776a4d-776a54 124->140 125->103 125->115 126->121 133 776b17-776b1d 127->133 134 776af8-776afb 127->134 139 776b59-776b68 128->139 136 776a18 129->136 133->120 133->126 138 776afd-776b03 134->138 136->107 138->133 141 776b05-776b15 138->141 139->139 142 776b6a 139->142 143 776a56-776a5b 140->143 144 776a80-776a83 140->144 141->133 141->138 142->103 143->144 145 776a5d-776a65 143->145 146 776a88-776a8f 144->146 147 776a67-776a6e 145->147 148 776a78-776a7e 145->148 146->146 149 776a91-776aa5 call 776471 146->149 150 776a6f-776a76 147->150 148->143 148->144 149->129 150->148 150->150
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 007764AF: GetOEMCP.KERNEL32(00000000,?,?,?,007784B9), ref: 007764DA
                                                                                                                                                                • IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,007767C6,?,00000000,?,?,007784B9), ref: 007769E0
                                                                                                                                                                • GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,007767C6,?,00000000,?,?,007784B9), ref: 00776A22
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000020.00000002.2885770705.0000000000771000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00770000, based on PE: true
                                                                                                                                                                • Associated: 00000020.00000002.2885647720.0000000000770000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885853163.000000000077D000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885948648.0000000000783000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2886039666.0000000000785000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_32_2_770000_AVGBrowserCrashHandler.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CodeInfoPageValid
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 546120528-0
                                                                                                                                                                • Opcode ID: 081a4ec59dabd571f8b7242614b81c2099efbdba5b2f4d22d57fcc208cb7d22f
                                                                                                                                                                • Instruction ID: a4d72a7bd0cdeae49b187774c0a9c70395b28c052bfb700b765af7eec02734c9
                                                                                                                                                                • Opcode Fuzzy Hash: 081a4ec59dabd571f8b7242614b81c2099efbdba5b2f4d22d57fcc208cb7d22f
                                                                                                                                                                • Instruction Fuzzy Hash: 665122B0A00A459EDF21CF39C840AAABBF5EF41380F18C16ED08ED7256E67C9945CB80
                                                                                                                                                                Function 00777E1C Relevance: 3.0, APIs: 2, Instructions: 34COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 153 777e1c-777e2b call 777b10 156 777e54-777e6e call 777e79 LCMapStringW 153->156 157 777e2d-777e52 LCMapStringEx 153->157 161 777e74-777e76 156->161 157->161
                                                                                                                                                                APIs
                                                                                                                                                                • LCMapStringEx.KERNELBASE(?,0077941E,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00777E50
                                                                                                                                                                • LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,0077941E,?,?,00000000,?,00000000), ref: 00777E6E
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000020.00000002.2885770705.0000000000771000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00770000, based on PE: true
                                                                                                                                                                • Associated: 00000020.00000002.2885647720.0000000000770000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885853163.000000000077D000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885948648.0000000000783000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2886039666.0000000000785000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_32_2_770000_AVGBrowserCrashHandler.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: String
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2568140703-0
                                                                                                                                                                • Opcode ID: fd34d090209e210227716ce205dace7e365188332dea8183b3b6baea648c7a26
                                                                                                                                                                • Instruction ID: 841400878c8ba914d0dd467803105c6aa5889f38871b30ebe9bd3c25e77ed64a
                                                                                                                                                                • Opcode Fuzzy Hash: fd34d090209e210227716ce205dace7e365188332dea8183b3b6baea648c7a26
                                                                                                                                                                • Instruction Fuzzy Hash: 86F0683210411ABBCF166FA0DC059DE3F26AF487A0F158550BA1825020C77AC871EB90
                                                                                                                                                                Function 007757E1 Relevance: 2.6, APIs: 2, Instructions: 67COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 162 7757e1-7757f5 GetLastError 163 7757f7-7757ff call 777d50 162->163 164 775811-77581b call 777d8f 162->164 171 775801-77580a 163->171 172 77580c 163->172 169 775821-775829 call 775dae 164->169 170 77581d-77581f 164->170 175 77582e-775834 169->175 173 775886-775891 SetLastError 170->173 171->173 172->164 176 775847-775855 call 777d8f 175->176 177 775836-775845 call 777d8f 175->177 183 775857-775865 call 777d8f 176->183 184 77586e-775883 call 7754be call 775e0b 176->184 182 775866-77586c call 775e0b 177->182 191 775885 182->191 183->182 184->191 191->173
                                                                                                                                                                APIs
                                                                                                                                                                • GetLastError.KERNEL32(?,00000000,00775DA0,00778DE9,?,007785C5,?,?,00000000,?,?,0077862A,?,007784B9,00000000,?), ref: 007757E5
                                                                                                                                                                • SetLastError.KERNEL32(00000000,?,00000000,007784B9,?,?,?,00782668,0000002C,0077852A,?,?,?), ref: 00775887
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000020.00000002.2885770705.0000000000771000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00770000, based on PE: true
                                                                                                                                                                • Associated: 00000020.00000002.2885647720.0000000000770000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885853163.000000000077D000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885948648.0000000000783000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2886039666.0000000000785000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_32_2_770000_AVGBrowserCrashHandler.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLast
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1452528299-0
                                                                                                                                                                • Opcode ID: c9e0673786f50079c1235ce20ac2fcebb239dd2ca1ac00e1a385def29af9346c
                                                                                                                                                                • Instruction ID: 491edba7baf9ace755170be46d5ae8630df78be84ece310ed317473e8fa2abfa
                                                                                                                                                                • Opcode Fuzzy Hash: c9e0673786f50079c1235ce20ac2fcebb239dd2ca1ac00e1a385def29af9346c
                                                                                                                                                                • Instruction Fuzzy Hash: 3611CE31358A01EFDF202BA59CCAA7B2659EF00BE4B34C235F40CD10A1EADC4D0182A5
                                                                                                                                                                Function 00776583 Relevance: 1.6, APIs: 1, Instructions: 147COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 194 776583-7765a5 195 7766be-7766e4 194->195 196 7765ab-7765bd GetCPInfo 194->196 198 7766e9-7766ee 195->198 196->195 197 7765c3-7765ca 196->197 199 7765cc-7765d6 197->199 200 7766f0-7766f6 198->200 201 7766f8-7766fe 198->201 199->199 204 7765d8-7765eb 199->204 205 776706-776708 200->205 202 776700-776703 201->202 203 77670a 201->203 202->205 206 77670c-77671e 203->206 207 77660c-77660e 204->207 205->206 206->198 208 776720-77672e call 771005 206->208 209 776610-776647 call 77764d call 77951e 207->209 210 7765ed-7765f4 207->210 220 77664c-776681 call 77951e 209->220 212 776603-776605 210->212 216 776607-77660a 212->216 217 7765f6-7765f8 212->217 216->207 217->216 219 7765fa-776602 217->219 219->212 223 776683-77668d 220->223 224 77668f-776699 223->224 225 77669b-77669d 223->225 226 7766ad-7766ba 224->226 227 77669f-7766a9 225->227 228 7766ab 225->228 226->223 229 7766bc 226->229 227->226 228->226 229->208
                                                                                                                                                                APIs
                                                                                                                                                                • GetCPInfo.KERNEL32(E8458D00,?,007767D2,007767C6,00000000), ref: 007765B5
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000020.00000002.2885770705.0000000000771000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00770000, based on PE: true
                                                                                                                                                                • Associated: 00000020.00000002.2885647720.0000000000770000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885853163.000000000077D000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885948648.0000000000783000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2886039666.0000000000785000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_32_2_770000_AVGBrowserCrashHandler.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Info
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1807457897-0
                                                                                                                                                                • Opcode ID: 686247ef15a8308567c01b1bb23eb8951648acc05e458104ebc338ac599cc21b
                                                                                                                                                                • Instruction ID: e9c63e0337af787fa66b7df865cf21d94bd766db23335cc0439ce62b4e8085e6
                                                                                                                                                                • Opcode Fuzzy Hash: 686247ef15a8308567c01b1bb23eb8951648acc05e458104ebc338ac599cc21b
                                                                                                                                                                • Instruction Fuzzy Hash: 5B5177715042589BCF218F28CD84AE67BB8EB45384F2485EDE19ED7086D239AE46DF20
                                                                                                                                                                Function 00777C0F Relevance: 1.6, APIs: 1, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 230 777c0f-777c37 231 777c3d-777c3f 230->231 232 777c39-777c3b 230->232 234 777c45-777c4c call 777b44 231->234 235 777c41-777c43 231->235 233 777c8e-777c91 232->233 237 777c51-777c55 234->237 235->233 238 777c57-777c65 GetProcAddress 237->238 239 777c74-777c8b 237->239 238->239 240 777c67-777c72 call 773fcb 238->240 241 777c8d 239->241 240->241 241->233
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000020.00000002.2885770705.0000000000771000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00770000, based on PE: true
                                                                                                                                                                • Associated: 00000020.00000002.2885647720.0000000000770000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885853163.000000000077D000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885948648.0000000000783000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2886039666.0000000000785000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_32_2_770000_AVGBrowserCrashHandler.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 157d70309717da31356c5b4fdc044577dcea306bb049cc009c34ec982c9a4f37
                                                                                                                                                                • Instruction ID: 05a08156d02474a2dd7b006c07117630875c229b4bcd169a7e458567662de7e1
                                                                                                                                                                • Opcode Fuzzy Hash: 157d70309717da31356c5b4fdc044577dcea306bb049cc009c34ec982c9a4f37
                                                                                                                                                                • Instruction Fuzzy Hash: EE0124337082159FDF1B8E6DED4095A37ABAB887A0724C120FA08CF194DB38CC01C7A4
                                                                                                                                                                Function 00775DAE Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 244 775dae-775db9 245 775dc7-775dcd 244->245 246 775dbb-775dc5 244->246 248 775de6-775df7 RtlAllocateHeap 245->248 249 775dcf-775dd0 245->249 246->245 247 775dfb-775e06 call 775d9b 246->247 254 775e08-775e0a 247->254 250 775dd2-775dd9 call 774abc 248->250 251 775df9 248->251 249->248 250->247 257 775ddb-775de4 call 778024 250->257 251->254 257->247 257->248
                                                                                                                                                                APIs
                                                                                                                                                                • RtlAllocateHeap.NTDLL(00000008,00000000,00000000,?,0077582E,00000001,00000364,00000000,00000002,000000FF,?,007785C5,?,?,00000000), ref: 00775DEF
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000020.00000002.2885770705.0000000000771000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00770000, based on PE: true
                                                                                                                                                                • Associated: 00000020.00000002.2885647720.0000000000770000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885853163.000000000077D000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885948648.0000000000783000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2886039666.0000000000785000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_32_2_770000_AVGBrowserCrashHandler.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocateHeap
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1279760036-0
                                                                                                                                                                • Opcode ID: d1e5bc846d4048fc37ed94d0aab7f3c3ac77720beb242d71378d8e97ecbf6199
                                                                                                                                                                • Instruction ID: 51effdf9a1085c486bb647e7ab5f4f1d6b97934222d1f27848c294890ff75078
                                                                                                                                                                • Opcode Fuzzy Hash: d1e5bc846d4048fc37ed94d0aab7f3c3ac77720beb242d71378d8e97ecbf6199
                                                                                                                                                                • Instruction Fuzzy Hash: F3F0B431348E21A7EF355B629C8DB5A3798DF417E0B29C025B81CA6085DFE8DC01C6E0

                                                                                                                                                                Non-executed Functions

                                                                                                                                                                Function 007716EA Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 007716F6
                                                                                                                                                                • IsDebuggerPresent.KERNEL32 ref: 007717C2
                                                                                                                                                                • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 007717E2
                                                                                                                                                                • UnhandledExceptionFilter.KERNEL32(?), ref: 007717EC
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000020.00000002.2885770705.0000000000771000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00770000, based on PE: true
                                                                                                                                                                • Associated: 00000020.00000002.2885647720.0000000000770000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885853163.000000000077D000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885948648.0000000000783000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2886039666.0000000000785000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_32_2_770000_AVGBrowserCrashHandler.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 254469556-0
                                                                                                                                                                • Opcode ID: 631c8b5feae32d94db028163bca3292cc87e395a709edc19487c1904f4adbb07
                                                                                                                                                                • Instruction ID: 81d3de882a3231d2f5b73fc6a5bb56e75dbb473fb2df0b535d5da4b7b9b08668
                                                                                                                                                                • Opcode Fuzzy Hash: 631c8b5feae32d94db028163bca3292cc87e395a709edc19487c1904f4adbb07
                                                                                                                                                                • Instruction Fuzzy Hash: C7310775D05218DBDF20DFA4D989BCDBBB8AF08344F5080AAE40DAB250EB759A85CF45
                                                                                                                                                                Function 0077318B Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • IsInExceptionSpec.LIBVCRUNTIME ref: 00773288
                                                                                                                                                                • type_info::operator==.LIBVCRUNTIME ref: 007732AA
                                                                                                                                                                • ___TypeMatch.LIBVCRUNTIME ref: 007733B9
                                                                                                                                                                • IsInExceptionSpec.LIBVCRUNTIME ref: 0077348B
                                                                                                                                                                • _UnwindNestedFrames.LIBCMT ref: 0077350F
                                                                                                                                                                • CallUnexpected.LIBVCRUNTIME ref: 0077352A
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000020.00000002.2885770705.0000000000771000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00770000, based on PE: true
                                                                                                                                                                • Associated: 00000020.00000002.2885647720.0000000000770000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885853163.000000000077D000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885948648.0000000000783000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2886039666.0000000000785000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_32_2_770000_AVGBrowserCrashHandler.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
                                                                                                                                                                • String ID: csm$csm$csm
                                                                                                                                                                • API String ID: 2123188842-393685449
                                                                                                                                                                • Opcode ID: 15a7d8050d25f4e34d49d444ba828625e5efff21be73035413e4a60cfeb15196
                                                                                                                                                                • Instruction ID: 2129b54f8ca62308407ef9cb2ce92c50fb023ac4340a9439e0e488ba82aafe06
                                                                                                                                                                • Opcode Fuzzy Hash: 15a7d8050d25f4e34d49d444ba828625e5efff21be73035413e4a60cfeb15196
                                                                                                                                                                • Instruction Fuzzy Hash: 8EB1AC71D00209EFCF29DFA5C8859AEBBB5BF04390B14C159E8186B212D739DB52EF91
                                                                                                                                                                Function 00772261 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetLastError.KERNEL32(?,?,00772258,00771F2C,007718CE), ref: 0077226F
                                                                                                                                                                • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0077227D
                                                                                                                                                                • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00772296
                                                                                                                                                                • SetLastError.KERNEL32(00000000,00772258,00771F2C,007718CE), ref: 007722E8
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000020.00000002.2885770705.0000000000771000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00770000, based on PE: true
                                                                                                                                                                • Associated: 00000020.00000002.2885647720.0000000000770000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885853163.000000000077D000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885948648.0000000000783000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2886039666.0000000000785000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_32_2_770000_AVGBrowserCrashHandler.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLastValue___vcrt_
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3852720340-0
                                                                                                                                                                • Opcode ID: 151b3698fd7a36b891bd093864caa3221a2afe7203eeb40c055cf14fb6c299cb
                                                                                                                                                                • Instruction ID: c5993b00bb67cabdf6e568147f1b98d9a7c1e2f8d88bf2566795b983420e33ab
                                                                                                                                                                • Opcode Fuzzy Hash: 151b3698fd7a36b891bd093864caa3221a2afe7203eeb40c055cf14fb6c299cb
                                                                                                                                                                • Instruction Fuzzy Hash: DD01F533948311AEAE2137787C8992A2B65FB047F4731C229F438401F3EB5D8D539248
                                                                                                                                                                Function 0077487C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,F154ADE5,?,?,00000000,0077CD1F,000000FF,?,0077484F,0077493C,?,00774823,00000000), ref: 007748B1
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 007748C3
                                                                                                                                                                • FreeLibrary.KERNEL32(00000000,?,?,00000000,0077CD1F,000000FF,?,0077484F,0077493C,?,00774823,00000000), ref: 007748E5
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000020.00000002.2885770705.0000000000771000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00770000, based on PE: true
                                                                                                                                                                • Associated: 00000020.00000002.2885647720.0000000000770000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885853163.000000000077D000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885948648.0000000000783000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2886039666.0000000000785000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_32_2_770000_AVGBrowserCrashHandler.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                • API String ID: 4061214504-1276376045
                                                                                                                                                                • Opcode ID: 7da96ce5544161d5f06cbfe45f2ddba65321ece33f12e9d37dd4f8c25e059299
                                                                                                                                                                • Instruction ID: 4c909fcbf24fdd77d2fbc6293863dabe204d17994449fcbbf94c0e372494ddce
                                                                                                                                                                • Opcode Fuzzy Hash: 7da96ce5544161d5f06cbfe45f2ddba65321ece33f12e9d37dd4f8c25e059299
                                                                                                                                                                • Instruction Fuzzy Hash: 9D01A271A44659AFCF219B94DC05BAEBBB8FF04B90F008535E815A2690DB7C9D00CB94
                                                                                                                                                                Function 007797FC Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetConsoleOutputCP.KERNEL32(F154ADE5,?,00000000,?), ref: 0077985F
                                                                                                                                                                  • Part of subcall function 00776C9D: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,007794D5,?,00000000,-00000008), ref: 00776D49
                                                                                                                                                                • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00779ABA
                                                                                                                                                                • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00779B02
                                                                                                                                                                • GetLastError.KERNEL32 ref: 00779BA5
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000020.00000002.2885770705.0000000000771000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00770000, based on PE: true
                                                                                                                                                                • Associated: 00000020.00000002.2885647720.0000000000770000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885853163.000000000077D000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885948648.0000000000783000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2886039666.0000000000785000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_32_2_770000_AVGBrowserCrashHandler.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2112829910-0
                                                                                                                                                                • Opcode ID: b90740f76150d43f13858623c72c79c99fa8433d63860167b7233a5dadb5a746
                                                                                                                                                                • Instruction ID: f9ccb1199af45db1dc9e8fdc295c9d6330ba22500be269a467b37261d8f39258
                                                                                                                                                                • Opcode Fuzzy Hash: b90740f76150d43f13858623c72c79c99fa8433d63860167b7233a5dadb5a746
                                                                                                                                                                • Instruction Fuzzy Hash: E5D16AB5D01248DFCF15CFA8D8809ADBBB5FF48350F18816AEA59EB351D734A942CB50
                                                                                                                                                                Function 00772F34 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000020.00000002.2885770705.0000000000771000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00770000, based on PE: true
                                                                                                                                                                • Associated: 00000020.00000002.2885647720.0000000000770000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885853163.000000000077D000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885948648.0000000000783000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2886039666.0000000000785000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_32_2_770000_AVGBrowserCrashHandler.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AdjustPointer
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1740715915-0
                                                                                                                                                                • Opcode ID: 8d7753df42b5359826ae26446e5ab8921dd28100182aca6ef81c1188998d070e
                                                                                                                                                                • Instruction ID: 2a1729ae6ad0d76097dcd468da31484fb130a66034c48b9a771c66f840bb0f26
                                                                                                                                                                • Opcode Fuzzy Hash: 8d7753df42b5359826ae26446e5ab8921dd28100182aca6ef81c1188998d070e
                                                                                                                                                                • Instruction Fuzzy Hash: 9E51B172600206DFEF299F14C845BBA77B6EF44790F14C12DE85947292E739EE81EB90
                                                                                                                                                                Function 007777F3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00775E0B: HeapFree.KERNEL32(00000000,00000000,?,007774C1,?,00000000,?,?,007774E6,?,00000007,?,?,0077798A,?,?), ref: 00775E21
                                                                                                                                                                  • Part of subcall function 00775E0B: GetLastError.KERNEL32(?,?,007774C1,?,00000000,?,?,007774E6,?,00000007,?,?,0077798A,?,?), ref: 00775E2C
                                                                                                                                                                • ___free_lconv_mon.LIBCMT ref: 00777837
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000020.00000002.2885770705.0000000000771000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00770000, based on PE: true
                                                                                                                                                                • Associated: 00000020.00000002.2885647720.0000000000770000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885853163.000000000077D000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885948648.0000000000783000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2886039666.0000000000785000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_32_2_770000_AVGBrowserCrashHandler.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorFreeHeapLast___free_lconv_mon
                                                                                                                                                                • String ID: @6x$H6x
                                                                                                                                                                • API String ID: 4068849827-1157458387
                                                                                                                                                                • Opcode ID: e3e8144d23043ccec8c77097d432aa880ee3bca3cb2af876da30ed6ed329a8e3
                                                                                                                                                                • Instruction ID: 07de789118b516ddfcfcf3884549473cc99a2ec03b4fcf069a81940e31cfdf9b
                                                                                                                                                                • Opcode Fuzzy Hash: e3e8144d23043ccec8c77097d432aa880ee3bca3cb2af876da30ed6ed329a8e3
                                                                                                                                                                • Instruction Fuzzy Hash: 92311E31604705EFDF35AB79D849B5A77E9BB00390F24C829E09DDB151DAB8EE80CB51
                                                                                                                                                                Function 00773535 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0077355A
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000020.00000002.2885770705.0000000000771000.00000020.00000001.01000000.0000002A.sdmp, Offset: 00770000, based on PE: true
                                                                                                                                                                • Associated: 00000020.00000002.2885647720.0000000000770000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885853163.000000000077D000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2885948648.0000000000783000.00000004.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                • Associated: 00000020.00000002.2886039666.0000000000785000.00000002.00000001.01000000.0000002A.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_32_2_770000_AVGBrowserCrashHandler.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: EncodePointer
                                                                                                                                                                • String ID: MOC$RCC
                                                                                                                                                                • API String ID: 2118026453-2084237596
                                                                                                                                                                • Opcode ID: 0c38f4abd0e6757ea2810f9f24acb3a519880bfa1758795732e0c974fdb4e4a4
                                                                                                                                                                • Instruction ID: 8ea265594babcea0495b89fdf55b2b1f3e4d6a1325b78569e5f9dfcabad358cf
                                                                                                                                                                • Opcode Fuzzy Hash: 0c38f4abd0e6757ea2810f9f24acb3a519880bfa1758795732e0c974fdb4e4a4
                                                                                                                                                                • Instruction Fuzzy Hash: 81416C71900209EFCF15DFA8CD85AAE7BB5FF48384F14C059F918A7211D3399A61EB50